[ale] undelete on ext3 Quasi-success!!

[James P. Kinney III]

I have some quasi-good news on undeleting/recovering files from ext3
file systems.

I grabbed a tool called lde (http://lde.sourceforge.net), used an old
disk and mke2fs -j a filesystem onto it. Made a simple text file. (69b
long). Then rm and unmount the partition.

I then ran lde, selected "block mode" (b) searched for a string in my
old text file and the appended that entire block to a file in /tmp.

The good news is, it works at getting the data back. The bad news is,
Drew's gonna be offline for a week as there is no automatic process on
this (argh!) and it's going to have to be manual for each block.

I will admit, I made this pretty simple. The file was all there was on
the partition. The inodes  are empty so something must be known about
the content of the files to find them. Or else a really good disk
wizard/genie will need to appear to explain better how to navigate at
the really raw block/inode/sector level on a drive.


-- 
James P. Kinney III   \Changing the mobile computing world/
President and CEO      \          one Linux user         /
Local Net Solutions,LLC \           at a time.          /
770-493-8244             \.___________________________./

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7 



 This is a digitally signed message part