Re: [tlug] debugfs on ext3 filesystems?

[Sigurd Urdahl <sigurdur@example.com>]

scott wrote:
> Hi everyone,
>
>  I was studying the command debugfs and was trying to search for deleted
> inodes on an ext3 filesystem, but none ever came up, even after deleting
> a file, unmounting the partition, and running debugfs. Googling around a
> bit I came up with a post saying essentially that ext3 journaling
> filesystems make restoring files via deleted inodes impossible.
>
>   
Unfortunately I believe that post is correct, there is no sane way of 
doing "undelete" in ext3.

I have recovered text files and email by dd'ing a partition through the 
strings command and searching the output, but this of course is trickier 
with binary data.

Birkir's suggestion of trying photorec seems a good idea, it's a tool I 
didn't know about and I'm moving it straight into my toolbox right 
now:-) It probably does the dd|strings trick in a much smarter way than 
me;-)

kind regards,
-sig