Re: [gentoo-user] undelete files and dirs on ext3 partition

[pat]

On Fri, 15 Feb 2008 12:01:25 +0100, Alex Schuster wrote
> Uwe Thiem writes:
>
> > On Friday 15 February 2008, pat wrote:
> > > On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote
> > >
> > > > Neil, you are a master of understatement :-)
> > > >
> > > > pat, it might be possible to get some stuff back, IF he remounted
> > > > ro immediately and IF not much writing to the disk happened in
> > > > the meantime.
> > > >
> > > > However, by the time you are done it is usually not worth the
> > > > effort it took. It's easier to reinstall and restore backups. But
> > > > if there are some irreplaceable files on that disk, you have no
> > > > choice. good luck to him.
> > >
> > > There's a home directory ... .
> >
> > What do you mean, Pat? /home still exists and is populated?
>
> I think he means there _was_ a /home directory.
>
> I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See <http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec> for a list of supported file types.
>
> There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu).
>
> I did not try it, but this tool sounds promising:
> http://freshmeat.net/projects/giis
>
> giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery.
>

Yes, there was the home directory.

Thanks to all for the help.

     Pat