[NTLUG:Discuss] ANY way to undelete a file in ext3? (The situation)

[Jerry Brillowski - LNX Technologies]

Thanks Will for the link, but unfortunately I've seen links to this
comment in the ext3-faq all over the web.  BUT, I sure would think there
"may" be something out there that you can still do to undelete, even
with an ext3 partition.  

With the following, I think my chances might be better than most:

 - The deleted file is on a separate partition that hasn't been written
to.
 - The machine hasn't been shut down, so its state should be exactly the
same as it was right after the deletion.  
 - The deletion was also done via Samba from a Macintosh.  (Not that
this should matter to my knowledge.)

HOPEFULLY, this all might put me in a better position for recovery.

So once again, I'm still open to suggestions!

Thanks again,

Jerry Brillowski 




-----Original Message-----
From: discuss-bounces at ntlug.org [mailto:discuss-bounces at ntlug.org] On
Behalf Of Will Senn
Sent: Thursday, September 09, 2004 11:50 AM
To: NTLUG Discussion List
Subject: Re: [NTLUG:Discuss] Ok, I give. Is there ANY way to undelete a
file in ext3?

Jerry,

If this information is correct, it's bad news. Taken from the EXT 3 FAQ 
at http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html:
----------
Q: How can I recover (undelete) deleted files from my ext3 partition?
Actually, you can't! This is what one of the developers, Andreas Dilger,

said about it:

In order to ensure that ext3 can safely resume an unlink after a crash, 
it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks 
the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been 
deleted and hope for the best.
----------

Thanks,

Will


Jerry Brillowski - LNX Technologies wrote:

> Thanks in advance for any clues.
> 
> - Jerry Brillowski
> 
> 
> _______________________________________________
> https://ntlug.org/mailman/listinfo/discuss
> 

_______________________________________________
https://ntlug.org/mailman/listinfo/discuss