Re: [Sheflug] Recovering a deleted file

[Nicola Richmond <n.j.richmond [at] xxxxxxxxxxxxxxx>]

On Wed, 2003-06-25 at 13:31, Matthew Collins wrote:
> On Wed, Jun 25, 2003 at 12:53:03PM +0100, Nicola Richmond wrote:
> > Sorry for not specifying the file system. Unfortunately it's ext3 so I
> > think there's little hope.  
> 
> Apart from the Journal file ext3 and ext2 have little else changed in
> on-disk structures.
> 
> Any guide to un-deleteing files on ext2 should work with ext3 as well.

During my extensive search of the web, I came across this

"Q: How can I recover (undelete) deleted files from my ext3 partition?
Actually, you can't! This is what one of the developers, Andreas Dilger,
said about it:

In order to ensure that ext3 can safely resume an unlink after a crash,
it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks
the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been
deleted and hope for the best."


Which is where I got the grep idea from. I suppose I have to remember
exactly what is in my file and extract is line-by-line?

I tried using debugfs and looking for deleted inodes but I always got 0
deleted inodes as a response.

I might just give up anyway. Cheers for the help though.

Nicola.

___________________________________________________________________

Sheffield Linux User's Group -
http://www.sheflug.co.uk/mailfaq.html

  GNU the choice of a complete generation.