Re: Undelete files on ext3 ??

Michael Milligan
2003-01-08T19:52:07Z

John Bradford wrote:
>>Is there any way to revert the stupid mistyping of "rm file *" on ext3??
>
> There is no simple way, no.
>
>>I hope there is a way, because I dont have a backup of some files i
>>mistakenly deleted
>
> The only thing I can suggest is this:
>
> * Do not write anything else to the partition, and immediately
> re-mount it read-only.
>
> E.G.:
>
> mount -oremount -oro /dev/hda3
>
> * Use dd to copy the entire contents of the partition to a file on
> another partition.
>
> E.G.:
>
> dd if=/dev/hda3 of=/partition_image
>
> * Search through that file for the fragments of your lost files.
>

This is where Lazarus from The Coroner's Toolkit might come in handy.
It's designed for ext2 though, not ext3, but it might work for you
nonetheless since ext3 is basically built on top of ext2.

http://www.cert.org/security-improvement/implementations/i046.03.html

Regards,
Mike

--
Michael Milligan -- Free Agent -- milli@acmeps.com