Undelete in EXT3?

[aiex]

Well yes i know this is the wrong forum but hey i couldn't find one it fitted in and, well, i've always liked OT.

I just did the plain stupid and managed to delete some files from my linux box which weren't backed up (i've not been able to back up recently because i've run out of space and don't have the money to buy more!). Unfortunatly it was in a network drive running on my mandrake box that uses the ext3 file system.

I found the files are still there by GREPing and then attached the drive to my windows box and used Stellar Phoenix Linux 2.5 to find that they are pretty much intact. Don't quite know how to get them back into reality though now. Anybody any clues? Unfortunatly i can't really afford to buy phoenix linux so i was wondering if anybody knows how it would work to recover these things manually?

Many thanks in advance from this complete muppet.

Alex

 

[Platypus]

You may find some help from my posts here:

http://forums.anandtech.com/messageview...atid=38&threadid=1826793&enterthread=y

Good luck!

 

[Platypus]

Unfortunately for you, ext3 zero's out the block pointers in inode instead of clearing them out like ext2.. this was by design. No undelete or recovery program will be able to help you unfortunately. Another problem is that it is a network drive.. even if you could connect to it and use a sector editor to search the baren wasteland of sectors out in the data clusters, which is a needle in a haystack, you'd still be hard up to do it.

Your only hope is the UNIX way of undeleting files that I described in the thread above.

Good luck man :\

 

[aiex]

Thanks for the response platypus. I do have access to the disk and i know that there is data there since both grep and Stellar Phoenix Linux have shown it to me. Only wish i could see the source code to Stellar Phoenix Linux so that i could work out how it restored the data! A friends helping me right now and we're just trying to make a program to grep for the start of the file. That shouldn't be too difficult since it is TIF files i'm looking for and their signature is 49 49 2A 00 and byte offset 0. The big problem then i guess is finding the end of the file and how it all fits toegter...

Alex

 

[Nothinman]

You could try e2undel or recover, but you'll need another Linux box to try them in since installing them on that drive could overwrite the data you're trying to recover.

 

[Platypus]

Originally posted by: Nothinman
You could try e2undel or recover, but you'll need another Linux box to try them in since installing them on that drive could overwrite the data you're trying to recover.

Those are for ext2 filesystems. Because of the nature of ext3, his data cannot be recovered by one of those programs.

You're on the right track by searching for hex strings.. problem is as you said that you need to know where it ends.. lots of guesswork ahead unfortunately. Good luck!

 

[Nothinman]

Those are for ext2 filesystems. Because of the nature of ext3, his data cannot be recovered by one of those programs.

But because the basic on-disk data structures are the same it still has a chance of working, and as long as he doesn't write to the filesystem with either of them there's no harm in trying.