Loading ...
Sorry, an error occurred while loading the content.

Re: [ttlug] Data recovery software from Linux

Expand Messages
  • Stephen Sankarsingh
    Q: How can I recover (undelete) deleted files from my ext3 partition?Actually, you can t! This is what one of the developers, Andreas Dilger, said about it:
    Message 1 of 9 , Sep 30, 2009
    • 0 Attachment
      Q: How can I recover (undelete) deleted files from my ext3
      partition?Actually, you can't! This is what one of the developers,
      Andreas Dilger,
      said about it:

      *In order to ensure that ext3 can safely resume an unlink after a crash, it
      actually zeros out the block pointers in the inode, whereas
      ext2 just marks these blocks as unused in the block bitmaps and marks the
      inode as "deleted" and leaves the block pointers alone.*

      *Your only hope is to "grep" for parts of your files that have been deleted
      and hope for the best.*
      http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html


      lsof works sometimes if the machine thinks that the file is open (not very
      useful). Has anyone found free software to recover files off an ext3
      partition which may have been deleted in error?

      /Stephen

      On Wed, Sep 30, 2009 at 9:51 AM, Trevor Christian <doubleOTeC@...>wrote:

      >
      >
      > Well I did ask the question more generally, as I've had people come to me
      > with all kinda lost files in the hope that I could recover it. And I have
      > in
      > the past, rebooted to the windows side of my machine (with great sorrow)
      > and
      > helped them out... It's occurred to me... why should I have to reboot?
      >
      > Thanks again...
      >
      >
      > Trevor "TeC" Christian
      > Cell #: (767) 225 4472 / (868) 687 0436
      > Home Page (http://www.trevorchristian.com/)
      >
      > 2009/9/30 Richard Jobity <richjob@... <richjob%40jobity.com>>
      >
      >
      > >
      > >
      > > I actually didn't know you were trying to recover pics off of a Flash
      > > drive. Otherwise I would have just said "Photorec".
      > >
      > > Nice functional app, crossplatform is a bonus. Unless your drive is
      > > dead dead dead.
      > >
      > > -rij
      > >
      > > Other solutions: Knoppix (oldie but goodie), among others.
      > >
      > > On the Windows side, Spinrite is good. Assembler, and (I think) OS
      > > agnostic. Not GPL or free, but very powerful, especially if you are
      > > dealing with a failing drive.
      > >
      > >
      > > Trevor Christian wrote:
      > > > Thanks
      > > >
      > > > Other data recovery solutions welcome, but this one work for the
      > > described
      > > > situation
      > > > It came with two applications "TestDisk" and "PhotoRec"
      > > >
      > > > The later of the two did the trick for the pictures I was attempting to
      > > > recover on a USB flash drive.
      > > >
      > > > 2009/9/30 Richard
      > > >
      > > >> http://www.cgsecurity.org/wiki/TestDisk
      > > >>
      > > >
      > > > Trevor "TeC" Christian
      > > > Cell #: (767) 225 4472 / (868) 687 0436
      > > > Home Page (http://www.trevorchristian.com/)
      > > >
      > > >
      > > > [Non-text portions of this message have been removed]
      > > >
      > > >
      > > >
      > > > ------------------------------------
      > > >
      > > > Help build TTLUG by forwarding this to anyone who is interested in the
      > > > subject matter or would otherwise benefit from joining the mailing
      > list.
      > > >
      > > > Trinidad and Tobago Linux Users Group
      > > http://groups.yahoo.com/group/ttlug
      > > > To subscribe, send an email to_______ TTLUG-subscribe@yahoogroups.com<TTLUG-subscribe%40yahoogroups.com>
      > <TTLUG-subscribe%40yahoogroups.com>
      > > > To unsubscribe, send an email to_____
      > TTLUG-unsubscribe@yahoogroups.com <TTLUG-unsubscribe%40yahoogroups.com>
      > <TTLUG-unsubscribe%40yahoogroups.com>
      > > > List owner/moderator Richard Jobity__ TTLUG-owner@yahoogroups.com<TTLUG-owner%40yahoogroups.com>
      > <TTLUG-owner%40yahoogroups.com>
      > > > Yahoo! Groups Links
      > > >
      > > >
      > > >
      > > >
      > >
      > >
      >
      > [Non-text portions of this message have been removed]
      >
      >
      >


      [Non-text portions of this message have been removed]
    • Falina Baksh
      The second link i pointed to has an article where the guy - after much much work - was able to recover his files from the journal using dd. ...
      Message 2 of 9 , Oct 1, 2009
      • 0 Attachment
        The second link i pointed to has an article where the guy - after much much
        work - was able to recover his files from the journal using dd.

        > However, this is not necessarily true. *All* information might still be
        > there, also the block pointers. It is just less likely that those are still
        > there (than on ext2), since they have to be recovered from the journal. On
        > top of that, the meta data is less coherently related to the real data so
        > that heuristic algorithms are needed to find things back. Every time a file
        > is accessed, it's Access Time is changed, and it's inode is written to disk,
        > along with 31 other inodes that reside in the same block. When that happens,
        > a copy of that block is written to the journal. Therefore, if your partition
        > isn't too large compared to your journal, and if you at least recently
        > accessed the files you want to recover, you might be able to recover the
        > block pointers from the journal.
        >
        > On February 7th, 2008, I accidently deleted my whole home directory: over 3
        > GB of data, deleted with rm -rf. The only backup that I had was from June
        > 2007. Not being able to undelete was *unacceptable*. So, I ignored what
        > everyone tried to tell me and started to learn how an ext3 file system
        > really works, and what *exactly* happens when files are deleted...
        >
        > Three weeks and nearly 5000 lines of code later, I had recovered every file
        > on my disk.
        >
        http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

        On 9/30/09, Stephen Sankarsingh <stephentnt@...> wrote:
        >
        >
        >
        > Q: How can I recover (undelete) deleted files from my ext3
        > partition?Actually, you can't! This is what one of the developers,
        > Andreas Dilger,
        > said about it:
        >
        > *In order to ensure that ext3 can safely resume an unlink after a crash, it
        > actually zeros out the block pointers in the inode, whereas
        > ext2 just marks these blocks as unused in the block bitmaps and marks the
        > inode as "deleted" and leaves the block pointers alone.*
        >
        > *Your only hope is to "grep" for parts of your files that have been deleted
        > and hope for the best.*
        > http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html
        >
        > lsof works sometimes if the machine thinks that the file is open (not very
        > useful). Has anyone found free software to recover files off an ext3
        > partition which may have been deleted in error?
        >
        > /Stephen
        >
        > On Wed, Sep 30, 2009 at 9:51 AM, Trevor Christian <doubleOTeC@...<doubleOTeC%40gmail.com>
        > >wrote:
        >
        > >
        > >
        > > Well I did ask the question more generally, as I've had people come to me
        > > with all kinda lost files in the hope that I could recover it. And I have
        > > in
        > > the past, rebooted to the windows side of my machine (with great sorrow)
        > > and
        > > helped them out... It's occurred to me... why should I have to reboot?
        > >
        > > Thanks again...
        > >
        > >
        > > Trevor "TeC" Christian
        > > Cell #: (767) 225 4472 / (868) 687 0436
        > > Home Page (http://www.trevorchristian.com/)
        > >
        > > 2009/9/30 Richard Jobity <richjob@... <richjob%40jobity.com><richjob%
        > 40jobity.com>>
        > >
        > >
        > > >
        > > >
        > > > I actually didn't know you were trying to recover pics off of a Flash
        > > > drive. Otherwise I would have just said "Photorec".
        > > >
        > > > Nice functional app, crossplatform is a bonus. Unless your drive is
        > > > dead dead dead.
        > > >
        > > > -rij
        > > >
        > > > Other solutions: Knoppix (oldie but goodie), among others.
        > > >
        > > > On the Windows side, Spinrite is good. Assembler, and (I think) OS
        > > > agnostic. Not GPL or free, but very powerful, especially if you are
        > > > dealing with a failing drive.
        > > >
        > > >
        > > > Trevor Christian wrote:
        > > > > Thanks
        > > > >
        > > > > Other data recovery solutions welcome, but this one work for the
        > > > described
        > > > > situation
        > > > > It came with two applications "TestDisk" and "PhotoRec"
        > > > >
        > > > > The later of the two did the trick for the pictures I was attempting
        > to
        > > > > recover on a USB flash drive.
        > > > >
        > > > > 2009/9/30 Richard
        > > > >
        > > > >> http://www.cgsecurity.org/wiki/TestDisk
        > > > >>
        > > > >
        > > > > Trevor "TeC" Christian
        > > > > Cell #: (767) 225 4472 / (868) 687 0436
        > > > > Home Page (http://www.trevorchristian.com/)
        > > > >
        > > > >
        > > > > [Non-text portions of this message have been removed]
        > > > >
        > > > >
        > > > >
        > > > > ------------------------------------
        > > > >
        > > > > Help build TTLUG by forwarding this to anyone who is interested in
        > the
        > > > > subject matter or would otherwise benefit from joining the mailing
        > > list.
        > > > >
        > > > > Trinidad and Tobago Linux Users Group
        > > > http://groups.yahoo.com/group/ttlug
        > > > > To subscribe, send an email to_______
        > TTLUG-subscribe@yahoogroups.com <TTLUG-subscribe%40yahoogroups.com>
        > <TTLUG-subscribe%40yahoogroups.com>
        > > <TTLUG-subscribe%40yahoogroups.com>
        > > > > To unsubscribe, send an email to_____
        > > TTLUG-unsubscribe@yahoogroups.com <TTLUG-unsubscribe%40yahoogroups.com><TTLUG-unsubscribe%
        > 40yahoogroups.com>
        > > <TTLUG-unsubscribe%40yahoogroups.com>
        > > > > List owner/moderator Richard Jobity__ TTLUG-owner@yahoogroups.com<TTLUG-owner%40yahoogroups.com>
        > <TTLUG-owner%40yahoogroups.com>
        > > <TTLUG-owner%40yahoogroups.com>
        > > > > Yahoo! Groups Links
        > > > >
        > > > >
        > > > >
        > > > >
        > > >
        > > >
        > >
        > > [Non-text portions of this message have been removed]
        > >
        > >
        > >
        >
        > [Non-text portions of this message have been removed]
        >
        >
        >



        --
        Rgds,
        Falina


        [Non-text portions of this message have been removed]
      Your message has been successfully submitted and would be delivered to recipients shortly.