[ale] undelete on ext3 Quasi-success!!

[Geoffrey]

This is too cool.  I don't know how large the text files were, but for 
the most part, text files are that large.  It could be that each resides 
in a single block.

When you say Drew will be offline for a week, do you mean that he's not 
going to be 'internet connected,' or something else?

James P. Kinney III wrote:
> I have some quasi-good news on undeleting/recovering files from ext3
> file systems.
> 
> I grabbed a tool called lde (http://lde.sourceforge.net), used an old
> disk and mke2fs -j a filesystem onto it. Made a simple text file. (69b
> long). Then rm and unmount the partition.
> 
> I then ran lde, selected "block mode" (b) searched for a string in my
> old text file and the appended that entire block to a file in /tmp.
> 
> The good news is, it works at getting the data back. The bad news is,
> Drew's gonna be offline for a week as there is no automatic process on
> this (argh!) and it's going to have to be manual for each block.
> 
> I will admit, I made this pretty simple. The file was all there was on
> the partition. The inodes  are empty so something must be known about
> the content of the files to find them. Or else a really good disk
> wizard/genie will need to appear to explain better how to navigate at
> the really raw block/inode/sector level on a drive.
> 
> 


-- 
Until later: Geoffrey		esoteric at 3times25.net

I didn't have to buy my radio from a specific company to listen
to FM, why doesn't that apply to the Internet (anymore...)?


---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.