[ale] undelete data ext3
Geoffrey
esoteric at 3times25.net
Sat Aug 24 14:51:15 EDT 2002
ChangingLINKS.com wrote:
> ALE, 08-24-02 1245
>
> 1. My data consisting text files (and 3 tar files) was in a partition called
> /data
> 2. Using a program that makes tasks easier, "rm -rf /data/save"
> 3. I realized the command was recursive. I figured out the /save directory was
> gone.
> 4. I immediately shut off power to the machine to keep the data intact.
> 5. I booted the machine (to copy some current files to floppy) and shut it
> down.
>
> 6. I tried downloading installing and using:
> recover-1.3.tar.gz
> mc-4.5.55.tar.gz
> unrm-0.92.tar.gz
> lde-2.6.0.tar.gz
>
> I was most "successful" with Midnight "mc" Commander. Using a ext2 floppy as a
> test, I was able to see attributes of the file that I deleted (and the size
> of the file seemed to remain the same). When I try to open the file, just see
> a bit of "machine language."
I think this test is not applicable because of the difference in the
filesystem types. I was 100% successful in retrieving 8 java source
files that I had deleted from an ext2 fs.
>
> I am a Luser - so I am not sure what to make of the results that I am getting.
> I should be able to undelete from a ext2 floppy - but it is not half as easy
> as a FAT32 or 16. Next, I want to try to format the floppy ext3 and undelete.
Testing with an ext3 fs would be a key attempt at this point.
>
> We can all agree that the data that I want to recover is still on the /data
> partition because I made sure that nothing ever wrote to the partition. The
> data should be "easier" to recover because it is mostly text files and the
> tar.gz files were in a separate directory called /code.
A couple of questions.
How large is the /data filesystem?
Do you have any idea of the size of the various files. It could be that
text files reside in a single block. Recalling some of the text from
each text file would be helpful as well.
Were the tar files tar format, or were they compressed. tar files have
a recognizable format as well, so locating the header info for the files
is possible.
If they were compressed, this would certainly make things a bit more
difficult.
Here's what I'm thinking, you read the file in raw mode, scanning for
the information which will identify the file locations.
>
> I am still not sure if ext3 can be undeleted "yet." I am thinking Geoffry had
> success, but I am not sure he undeleted from ext3.
No, it was ext2.
>
> Unfortunately, my "get paid to undelete" thread turned into jokes about losing
> code on Windows. Is there no one who can help me beat this problem? I refuse
> to lose this data.
Answer the questions above, we'll see where we can go from here.
--
Until later: Geoffrey esoteric at 3times25.net
I didn't have to buy my radio from a specific company to listen
to FM, why doesn't that apply to the Internet (anymore...)?
---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be
sent to listmaster at ale dot org.
More information about the Ale
mailing list