[ale] undelete data ext3

Geoffrey esoteric at 3times25.net
Sat Aug 24 14:51:15 EDT 2002


ChangingLINKS.com wrote:
> ALE, 08-24-02 1245
> 
> 1. My data consisting text files (and 3 tar files) was in a partition called 
> /data
> 2. Using a program that makes tasks easier, "rm -rf /data/save"
> 3. I realized the command was recursive. I figured out the /save directory was 
> gone.
> 4. I immediately shut off power to the machine to keep the data intact.
> 5. I booted the machine (to copy some current files to floppy) and shut it 
> down.
> 
> 6. I tried downloading installing and using:
>    recover-1.3.tar.gz
>    mc-4.5.55.tar.gz
>    unrm-0.92.tar.gz
>    lde-2.6.0.tar.gz
> 
> I was most "successful" with Midnight "mc" Commander. Using a ext2 floppy as a 
> test, I was able to see attributes of the file that I deleted (and the size 
> of the file seemed to remain the same). When I try to open the file, just see 
> a bit of "machine language."

I think this test is not applicable because of the difference in the 
filesystem types.  I was 100% successful in retrieving 8 java source 
files that I had deleted from an ext2 fs.

> 
> I am a Luser - so I am not sure what to make of the results that I am getting. 
> I should be able to undelete from a ext2 floppy - but it is not half as easy 
> as a FAT32 or 16. Next, I want to try to format the floppy ext3 and undelete.

Testing with an ext3 fs would be a key attempt at this point.

> 
> We can all agree that the data that I want to recover is still on the /data 
> partition because I made sure that nothing ever wrote to the partition. The 
> data should be "easier" to recover because it is mostly text files and the 
> tar.gz files were in a separate directory called /code. 

A couple of questions.

How large is the /data filesystem?

Do you have any idea of the size of the various files.  It could be that 
text files reside in a single block.  Recalling some of the text from 
each text file would be helpful as well.

Were the tar files tar format, or were they compressed.  tar files have 
a recognizable format as well, so locating the header info for the files 
is possible.

If they were compressed, this would certainly make things a bit more 
difficult.

Here's what I'm thinking, you read the file in raw mode, scanning for 
the information which will identify the file locations.

> 
> I am still not sure if ext3 can be undeleted "yet."  I am thinking Geoffry had 
> success, but I am not sure he undeleted from ext3.

No, it was ext2.

> 
> Unfortunately, my "get paid to undelete" thread turned into jokes about losing 
> code on Windows. Is there no one who can help me beat this problem? I refuse 
> to lose this data.

Answer the questions above, we'll see where we can go from here.



-- 
Until later: Geoffrey		esoteric at 3times25.net

I didn't have to buy my radio from a specific company to listen
to FM, why doesn't that apply to the Internet (anymore...)?


---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.






More information about the Ale mailing list