Re: ext3 file deletion

[Carl-Daniel Hailfinger <c-d.hailfinger.kernel.2003@gmx.net>]

Pablo Donzis wrote:
> Hi,
> 
> I have just made a mess. I deleted some important files on my ext3fs.
> Have you ever found a solution to undeletion issue in ext3?
> I'm in a real hurry.

This is not a real solution - more of a starting point. If you have
enough free space on *ANOTHER* partition, try to make a backup of the
partition that contains the filesystem *before* unmounting it.

If /foo is the mount point of the ext3fs with the deleted files
If /foo sits on /dev/hda5
If /bar has enough free space to hold a partition image of /dev/hda5

issue the following command:

dd if=/dev/hda5 of=/bar/image

and try to recover the data from the image. If the files are really
important, you can try to e2fsck the *image file* and attack it with
undeletion utilities (probably won't work) or mark all free blocks used
by hand, e2fsck the image file again and pick up the mess from /lost+found.


HTH,
Carl-Daniel
-- 
http://www.hailfinger.org/