From: Jan Hudec <bulb@ucw.cz>
To: Maciej Soltysiak <solt@dns.toxicfilms.tv>
Cc: John Bradford <john@grabjohn.com>,
Max Valdez <maxvaldez@yahoo.com>,
linux-kernel@vger.kernel.org
Subject: Re: Undelete files on ext3 ??
Date: Tue, 7 Jan 2003 10:45:47 +0100 [thread overview]
Message-ID: <20030107094547.GG2141@vagabond> (raw)
In-Reply-To: <Pine.LNX.4.44.0301071004550.30728-100000@dns.toxicfilms.tv>
On Tue, Jan 07, 2003 at 10:29:06AM +0100, Maciej Soltysiak wrote:
> > There is no simple way, no.
> What about IDE Taskfile access, it's help says something like it's the
> crown jewel of hard drive forensics.
>
> One question, how ext2/3 deletes files? similarily to fat by renaming the
> first character?
No. By removing the directory entry completely and marking the inode
unused.
By the way, there used to be undelete tool for ext2. It created a list
of deleted inodes with correct stat, but no names, only their inode
numbers. You could then pick the corect inode and give it a name, thus
bringing it back to life. Since ext3 is just ext2 with journal, I guess
it might work. It existed as a standalone tool and integrated to
midnight commander.
-------------------------------------------------------------------------------
Jan 'Bulb' Hudec <bulb@ucw.cz>
next prev parent reply other threads:[~2003-01-07 9:37 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-01-07 3:58 Undelete files on ext3 ?? Max Valdez
2003-01-07 8:59 ` Marco d'Itri
2003-01-07 8:59 ` John Bradford
2003-01-07 9:29 ` Maciej Soltysiak
2003-01-07 9:45 ` Jan Hudec [this message]
2003-01-07 17:38 ` Max Valdez
2003-01-07 17:53 ` Andreas Dilger
2003-01-07 17:57 ` John Bradford
2003-01-07 18:56 ` Andreas Dilger
2003-01-07 18:17 ` Richard B. Johnson
2003-01-07 18:41 ` Virtual WORM device John Bradford
2003-01-07 18:53 ` Andreas Dilger
2003-01-07 18:54 ` John Bradford
2003-01-08 18:24 ` Vishal Verma
2003-01-07 18:45 ` Undelete files on ext3 ?? Jesse Pollard
2003-01-07 18:55 ` Andreas Dilger
2003-01-08 5:01 ` Gerhard Mack
2003-01-08 8:00 ` Jan Hudec
2003-01-08 10:57 ` John Bradford
2003-01-08 21:33 ` Valdis.Kletnieks
2003-01-08 21:47 ` John Bradford
2003-01-08 21:51 ` Randy.Dunlap
2003-01-08 22:06 ` Valdis.Kletnieks
2003-01-08 23:03 ` John Bradford
2003-01-08 23:14 ` John Bradford
2003-01-09 9:42 ` Helge Hafting
2003-01-07 20:58 ` Mike Waychison
2003-01-09 8:27 ` Michael Knigge
[not found] ` <Pine.LNX.3.95.1030107131613.3523A-100000@chaos.analogic.co m>
2003-01-07 23:51 ` Billy Rose
2003-01-07 11:30 ` John Bradford
2003-01-07 11:45 ` Matti Aarnio
2003-01-07 12:39 ` Alan Cox
2003-01-08 20:00 ` Michael Milligan
2003-01-07 9:16 ` David van Hoose
2003-01-07 19:31 ` oford
2003-01-08 11:57 ` Pavel Machek
-- strict thread matches above, loose matches on Subject: below --
2003-01-07 9:58 Alexander Sandler
2003-01-08 10:03 bart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030107094547.GG2141@vagabond \
--to=bulb@ucw.cz \
--cc=john@grabjohn.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maxvaldez@yahoo.com \
--cc=solt@dns.toxicfilms.tv \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.