[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Undeleting files in ext3 (Newbie-question)



On Mon, Feb 18, 2002 at 10:41:27PM +0100, NovaLand wrote:
> Recently I've encountered a problem, and now I would preciate any help 
> about being able to undelete files.
> 
> My /var filestructured is mounted at /dev/hdc1
> Part of my /etc/mtab looks like this:
> /dev/hdc1 /var ext3 rw 0 0
> 
> I'm using the e2fsprogs-1.23-2 package currently installed with Redhat 7.2
> 
> So, could anyone give me a hint of how things could be done to find 
> deleted inodes?
> 
> I've tried to use debugfs , but I suspect this only helps if I'm using 
> ext2. Or does they support ext3 too?

You can use debugfs, but unfortunately, the way ext3 works the
allocated blocks in the deleted inodes get zapped when the inode is
deleted, unlike in ext2.  This means that the recovery tricks that
work when the filesystem is mounted as ext2 don't work under ext3.  

It would be really nice to fix this, but It Would Be Hard.

I'm thinking about ways in which the data saved by e2image could be
used to recover deleted files (assuming that the filesystem metadata
is regularly being backed up via e2image), but while it oculd be done,
it's a Mere Matter of Programming that hasn't been done yet.  And in
any case, it won't be able to recover the filename -> inode number
mapping information.  (You could save that information using e2image
-r, but that's a fairly slow and painful operation.)

						- Ted





[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]