Re: ext3 file deletion

Carl-Daniel Hailfinger (c-d.hailfinger.kernel.2003@gmx.net)
Tue, 13 May 2003 21:58:37 +0200


Pablo Donzis wrote:
> Hi,
>
> I have just made a mess. I deleted some important files on my ext3fs.
> Have you ever found a solution to undeletion issue in ext3?
> I'm in a real hurry.

This is not a real solution - more of a starting point. If you have
enough free space on *ANOTHER* partition, try to make a backup of the
partition that contains the filesystem *before* unmounting it.

If /foo is the mount point of the ext3fs with the deleted files
If /foo sits on /dev/hda5
If /bar has enough free space to hold a partition image of /dev/hda5

issue the following command:

dd if=/dev/hda5 of=/bar/image

and try to recover the data from the image. If the files are really
important, you can try to e2fsck the *image file* and attack it with
undeletion utilities (probably won't work) or mark all free blocks used
by hand, e2fsck the image file again and pick up the mess from /lost+found.

HTH,
Carl-Daniel

-- 
http://www.hailfinger.org/

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/