[ale] undelete on ext3

[ChangingLINKS.com]

Date:  Sun, 25 Aug 2002 09:58:12 -0400
From: "Geoffrey" <esoteric at 3times25.net> 
To: ale at ale.org
To: ale at ale.org
Subject: Re: [ale] undelete data ext3

 Christopher R. Curzio wrote:
 > It wasn't on ext3, but he's using ext2 undelete methods. 

 True, and I think we've pretty much determined that all the information 
 out there says this can't be done.  I've yet to hear anyone actually 
 try it though.  Drew did indicate he would try it, so I'm interested in 
 hearing how that goes.

***********
Yes, I am going to try. I refuse to lose the data because even on Windows, I 
have not lost this much data in all my years of using computers. I am 
prepared not to use the drive for years (when an undelete utility should be 
available) to save the data. At this point, I am not willing to pay $400. I 
hate to be the first to explore this theory because I don't have the skillwz 
- however, wit y'alls help, I'll give it a go.

 From: "Christopher Fowler" <cfowler at outpostsentinel.com> 
 To: x3 at changinglinks.com
 Subject: Re: [ale] undelete data ext3
 Date: Sat, 24 Aug 2002 14:20:20 -0400

 #6 probably was the death nail.  You should have mounted the disk in 
 read-only mode then tried the undelete in single user mode.  But 
 because you downloaded files to the disk then it is very possible that 
 Linux overwrote blocks that stored your good data with the blocks of 
 those files.  That may be the death of the data. 
********
Misunderstanding. #6 applied to the TESTS that I ran on TEST drives. I will 
not attempt to undelete the important data until I have mastery of undelete 
on ext3 on the test drives.

 But if you have been very carefule it may be possible to still recover this 
data.  
 Or parts  of it.  

********
The data is all still there.

 Can you tell me a little more about the files you are recovering?  I may can 
have you bring 
 the drive to me and I can see how much or how little I can recover.  Let me 
know some more 
 details.

********
The files are all .txt (except 3 tar.gz files that I DO NOT need) I am 
specifically trying to recover 1 .txt files that are about 100KB, and another 
that is 20KB (or less) in size. I would like to learn how to capture an image 
of the disk and burn that to CD if possible. The /data partition is only 
twice the size of a CDrom. @ 1500MB. And, the total amount of disk space that 
I was using before the delete was 302MB.


 Date:  Sat, 24 Aug 2002 14:51:15 -0400
 From: "Geoffrey" <esoteric at 3times25.net> 
 To: x3 at changinglinks.com
 CC: ale at ale.org
 Subject: Re: [ale] undelete data ext3

 I think this test is not applicable because of the difference in the 
 filesystem types.  I was 100% successful in retrieving 8 java source 
 files that I had deleted from an ext2 fs.

********
Some people argue that ext3 is not too different. Moreover, we all agree that 
since I did the delete, and dropped power to the computer (and the data is on 
a separate partition, that the data is techincally "still there."

>Testing with an ext3 fs would be a key attempt at this point.
>A couple of questions.

********
Can someone give me the commands to format a floppy ext3? The gui only allows 
a choice between ext2 and FAT16

 How large is the /data filesystem?
*******
1500MB

 Do you have any idea of the size of the various files.  It could be that 
 text files reside in a single block.  Recalling some of the text from 
 each text file would be helpful as well. 

*******
All of the files are 100KB give or take 4KB

 Were the tar files tar format, or were they compressed.  tar files have 
 a recognizable format as well, so locating the header info for the 
 files is possible.

 If they were compressed, this would certainly make things a bit more 
difficult.
*******
I do not want to recover the compressed tar files.


 Here's what I'm thinking, you read the file in raw mode, scanning for 
 the information which will identify the file locations.
 Answer the questions above, we'll see where we can go from here.
*******
That is what I want to try. I think we can all agree that it is the solution.
How do I read the disk in "raw mode?"

 Date:  Sat, 24 Aug 2002 20:28:13 -0400
 From: "Christopher R. Curzio" <ale at accipiter.org> 
 To: x3 at ChangingLINKS.com
 CC: ale at ale.org
 Subject: Re: [ale] undelete data ext3

 I don't think you're supposed to open the file then and there; you're
 supposed to copy it to another directory first. That's how I recovered
 about 30 tremendous files. It wasn't on ext3, but he's using ext2 undelete 
 methods.

******
I did copy the file to another directory before trying to read it. mc forces
me to make that choice.


-- 
Wishing you Happiness, Joy and Laughter,
Drew
http://www.ChangingLINKS.com

---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be
sent to listmaster at ale dot org.