From mboxrd@z Thu Jan 1 00:00:00 1970 From: Erik Mouw Subject: Re: How To Recover Files From ext3 Partition?? Date: Fri, 5 May 2006 13:18:07 +0200 Message-ID: <20060505111807.GD4900@harddisk-recovery.com> References: <20060504143814.GF16570@harddisk-recovery.com> <20060505051618.95519.qmail@web37902.mail.mud.yahoo.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: linux-fsdevel@vger.kernel.org, adilger@clusterfs.com Return-path: Received: from dtp.xs4all.nl ([80.126.206.180]:1612 "HELO abra2.bitwizard.nl") by vger.kernel.org with SMTP id S1030359AbWEELSI (ORCPT ); Fri, 5 May 2006 07:18:08 -0400 To: UZAIR LAKHANI Content-Disposition: inline In-Reply-To: <20060505051618.95519.qmail@web37902.mail.mud.yahoo.com> Sender: linux-fsdevel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org On Thu, May 04, 2006 at 10:16:18PM -0700, UZAIR LAKHANI wrote: > --- Erik Mouw wrote: > > On Thu, May 04, 2006 at 07:18:38AM -0700, UZAIR > > LAKHANI wrote: > > > Is there any way to recover the deleted files from > > a > > > folder in ext3 partition. Basically in one > > directory, > > > I gave the command (rm -rf *) and all the files > > and > > > folders of this directory are lost. How to recover > > > these. I had once found an article regarding > > > un-deleting ext2 files. > > > > It *should* work the same, though the the last time > > I tried such a > > recovery from and ext3 filesystem, ext3 made it > > particularly hard cause > > it zeros most of the inode on delete (including > > ext3_inode->i_block[]). > > Ext2 leaves much more information behind. > > > > You could try with the undelfs feature in Midnight > > Commander, but first > > be sure to mount the filesystem read-only in order > > to avoid any further > > changes. > > Thanks for the reply. Yes it is difficult to recover > files from ext3 as compared to ext2. I found this > helpful info from one website. > > Q: How can I recover (undelete) deleted files from my > ext3 partition? > Actually, you can't! This is what one of the > developers, Andreas Dilger, said about it: > In order to ensure that ext3 can safely resume an > unlink after a crash, it actually zeros out the block > pointers in the inode, whereas > ext2 just marks these blocks as unused in the block > bitmaps and marks the inode as "deleted" and leaves > the block pointers alone. > > Your only hope is to "grep" for parts of your files > that have been deleted and hope for the best. > > [Source] = > http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html Andreas, care to elaborate? AFAICS resetting ->i_mode to 0000, setting ->i_links_count to 0, and setting ->i_dtime should be enough to uniquely mark an inode as deleted. Doing so would make an occasional undelete much easier to recover for Joe Sixpack (and for us a lot less work to reconstruct files by scavenging the whole partition for clues). > Additionally where can I get the source for Midnight > Commander. IIRC it lives somewhere on ftp.gnome.org and/or on ftp.gnu.org. Look for mc-XXX.tar.gz. It started its life as a text based file manager similar to the Norton Commander. Later on it was used by the Gnome project to make a graphical file manager (gmc) which was later on replaced by Nautilus. Erik -- +-- Erik Mouw -- www.harddisk-recovery.com -- +31 70 370 12 90 -- | Lab address: Delftechpark 26, 2628 XH, Delft, The Netherlands