Re: How To Recover Files From ext3 Partition??

[Erik Mouw <erik@harddisk-recovery.com>]

On Thu, May 04, 2006 at 10:16:18PM -0700, UZAIR LAKHANI wrote:
> --- Erik Mouw <erik@harddisk-recovery.com> wrote:
> > On Thu, May 04, 2006 at 07:18:38AM -0700, UZAIR
> > LAKHANI wrote:
> > > Is there any way to recover the deleted files from
> > a
> > > folder in ext3 partition. Basically in one
> > directory,
> > > I gave the command (rm -rf *) and all the files
> > and
> > > folders of this directory are lost. How to recover
> > > these. I had once found an article regarding
> > > un-deleting ext2 files.
> > 
> > It *should* work the same, though the the last time
> > I tried such a
> > recovery from and ext3 filesystem, ext3 made it
> > particularly hard cause
> > it zeros most of the inode on delete (including
> > ext3_inode->i_block[]).
> > Ext2 leaves much more information behind.
> > 
> > You could try with the undelfs feature in Midnight
> > Commander, but first
> > be sure to mount the filesystem read-only in order
> > to avoid any further
> > changes.
> 
> Thanks for the reply. Yes it is difficult to recover
> files from ext3 as compared to ext2. I found this
> helpful info from one website.
> 
> Q: How can I recover (undelete) deleted files from my
> ext3 partition?
> Actually, you can't! This is what one of the
> developers, Andreas Dilger, said about it:
> In order to ensure that ext3 can safely resume an
> unlink after a crash, it actually zeros out the block
> pointers in the inode, whereas
> ext2 just marks these blocks as unused in the block
> bitmaps and marks the inode as "deleted" and leaves
> the block pointers alone.
> 
> Your only hope is to "grep" for parts of your files
> that have been deleted and hope for the best.
> 
> [Source] =
> http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html

Andreas, care to elaborate? AFAICS resetting ->i_mode to 0000, setting
->i_links_count to 0, and setting ->i_dtime should be enough to
uniquely mark an inode as deleted. Doing so would make an occasional
undelete much easier to recover for Joe Sixpack (and for us a lot less
work to reconstruct files by scavenging the whole partition for clues).

> Additionally where can I get the source for Midnight
> Commander.

IIRC it lives somewhere on ftp.gnome.org and/or on ftp.gnu.org. Look
for mc-XXX.tar.gz. It started its life as a text based file manager
similar to the Norton Commander. Later on it was used by the Gnome
project to make a graphical file manager (gmc) which was later on
replaced by Nautilus.


Erik

-- 
+-- Erik Mouw -- www.harddisk-recovery.com -- +31 70 370 12 90 --
| Lab address: Delftechpark 26, 2628 XH, Delft, The Netherlands