Re: ext4 undeletion question

["Michael B. Trausch" <mbt@zest.trausch.us>]

[-- Attachment #1: Type: text/plain, Size: 2439 bytes --]

(Andreas, sorry for the dup, forgot to hit reply-all the last time.  My
fault.)

On Tue, 28 Apr 2009 12:53:46 -0600
Andreas Dilger <adilger@sun.com> wrote:

> The good news is that ext4 usually allocates file blocks contiguously
> so if you can find the inodes themselves in the journal you can likely
> extract most of the data just by printing the in-inode extents to find
> the block ranges and then dumping the file data with 'dd'.

So, here's what my current situation is:

  * I deleted a .bzr directory which contains files and additional
    directories.  AFAIK, directories are just "files", but exposed
    differently to the operating system, yes?  So I should be able to,
    if I were to find its inode, find all of its descendants, too, to
    bring them back, right?  I don't have a directory listing from
    before the deletion, and I presume that would make all the
    difference in the world.  Also, I'd need to figure out which one
    would be the correct one; I've deleted other .bzr directories (as
    part of their directory trees) repeatedly in the past on this
    filesystem.

  * This filesystem was in fact created as ext4.  I'd attempted an
    upgrade some time ago, but the upgrade took *ages* and so I aborted
    it early, reformatted, and restored my home directory from a
    tarball on the new filesystem.

  * I know where in the directory tree the .bzr directory had a link,
    obviously.  I don't know if that information is helpful or not,
    though, unless having the inode # of the containing directory is
    useful in some way.

  * I don't know _anything_ about how journaling works, but I do know
    that the directory was about a week old (just young enough to not
    be on a backup; since some hardware changes were made I hadn't
    started my hourly rsnapshot back up since I don't currently have a
    drive to rsnapshot to---d'oh!)

I'd be happy to look into options, though as I mentioned in my previous
message, I am not a solid system-level programmer (at least in my own
personal opinion).  I could probably figure it out, given enough time,
but when it comes to C (or C++) I just plain _suck_.  I am trying to
improve that, though.

	--- Mike

-- 
I don't really know that anybody's proven that a random collection of
people doing their own thing actually creates value.
                            --- Steve Ballmer, 2007

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 197 bytes --]