[ale] Again with the filesystem recovery SOLUTION?

[Michael D. Hirsch]

On Monday 27 January 2003 08:25 pm, Geoffrey wrote:
>
> I'm going to do a bit of testing on this.  Someone else posted that you
> can mount an ext3 as ext2 and all you loose is journalling.  This sounds
> too simple. I would have thought that if you could do this, you could
> just as simply recover the files.

It's too late by then.  According to what we have learned in these threads, 
ext3 destroys the metadata about where the file was physically on the disk 
during deletes.  So once the delete happens it is very hard (not 
impossible) to find.  With ext2 and FAT16, when you delete a file you just 
remove the thing that makes the filesystem know to pay attention to the 
file, but leave the old metadata lieing around.  So if you can find the 
metadata (and it is in a very limited place) you can recover the file.

Switching to ext2 after the delete will get you no advantage whatsoever.  
You need to be in ext2 before you delete.  Of course, you lose all the 
nice journaling capabilities if you do that.

Michael
_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale