Message-ID: <3EC14E6D.7020602@gmx.net>
Date: Tue, 13 May 2003 21:58:37 +0200
From: Carl-Daniel Hailfinger <c-d.hailfinger.kernel.2003@gmx.net>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2) Gecko/20021126
MIME-Version: 1.0
To: Pablo Donzis <pablodonzis@anvet.com.ar>
CC: linux-kernel@vger.kernel.org
Subject: Re: ext3 file deletion
References: <1052844347.3ec1213b111b1@webmail.netizen.com.ar>
In-Reply-To: <1052844347.3ec1213b111b1@webmail.netizen.com.ar>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1190
Lines: 35

Pablo Donzis wrote:
> Hi,
> 
> I have just made a mess. I deleted some important files on my ext3fs.
> Have you ever found a solution to undeletion issue in ext3?
> I'm in a real hurry.

This is not a real solution - more of a starting point. If you have
enough free space on *ANOTHER* partition, try to make a backup of the
partition that contains the filesystem *before* unmounting it.

If /foo is the mount point of the ext3fs with the deleted files
If /foo sits on /dev/hda5
If /bar has enough free space to hold a partition image of /dev/hda5

issue the following command:

dd if=/dev/hda5 of=/bar/image

and try to recover the data from the image. If the files are really
important, you can try to e2fsck the *image file* and attack it with
undeletion utilities (probably won't work) or mark all free blocks used
by hand, e2fsck the image file again and pick up the mess from /lost+found.


HTH,
Carl-Daniel
-- 
http://www.hailfinger.org/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/