Re: Undelete files on ext3 ??

[Jan Hudec]

On Tue, Jan 07, 2003 at 10:29:06AM +0100, Maciej Soltysiak wrote:
> > There is no simple way, no.
> What about IDE Taskfile access, it's help says something like it's the
> crown jewel of hard drive forensics.
> 
> One question, how ext2/3 deletes files? similarily to fat by renaming the
> first character?

No. By removing the directory entry completely and marking the inode
unused.

By the way, there used to be undelete tool for ext2. It created a list
of deleted inodes with correct stat, but no names, only their inode
numbers. You could then pick the corect inode and give it a name, thus
bringing it back to life. Since ext3 is just ext2 with journal, I guess
it might work. It existed as a standalone tool and integrated to
midnight commander.

-------------------------------------------------------------------------------
						 Jan 'Bulb' Hudec <[e-mail]>