Mailing List Archive


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [tlug] debugfs on ext3 filesystems?



scott wrote:
Hi everyone,

 I was studying the command debugfs and was trying to search for deleted
inodes on an ext3 filesystem, but none ever came up, even after deleting
a file, unmounting the partition, and running debugfs. Googling around a
bit I came up with a post saying essentially that ext3 journaling
filesystems make restoring files via deleted inodes impossible.

Unfortunately I believe that post is correct, there is no sane way of doing "undelete" in ext3.

I have recovered text files and email by dd'ing a partition through the strings command and searching the output, but this of course is trickier with binary data.

Birkir's suggestion of trying photorec seems a good idea, it's a tool I didn't know about and I'm moving it straight into my toolbox right now:-) It probably does the dd|strings trick in a much smarter way than me;-)

kind regards,
-sig


Home | Main Index | Thread Index

Home Page Mailing List Linux and Japan TLUG Members Links