Re: [gentoo-user] undelete files and dirs on ext3 partition

[Alex Schuster]

Uwe Thiem writes:

> On Friday 15 February 2008, pat wrote:
> > On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote
> >
> > > Neil, you are a master of understatement :-)
> > >
> > > pat, it might be possible to get some stuff back, IF he remounted
> > > ro immediately and IF not much writing to the disk happened in
> > > the meantime.
> > >
> > > However, by the time you are done it is usually not worth the
> > > effort it took. It's easier to reinstall and restore backups. But
> > > if there are some irreplaceable files on that disk, you have no
> > > choice. good luck to him.
> >
> > There's a home directory ... .
>
> What do you mean, Pat? /home still exists and is populated?

I think he means there _was_ a /home directory.

I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See <http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec> for a list of supported file types.

There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu).

I did not try it, but this tool sounds promising:
http://freshmeat.net/projects/giis

giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery.

Good luck,
	Wonko