Re: undelete files and dirs on ext3 partition

8 msg	Missing .config
8 msg	printer uses UHCI instead of EHCI. Why?
1 msg	Error compiling sys-power/powersave
2 msg	RE: BT8x8
6 msg	[Query] Netowork Manager
1 msg	ghostscript alternatives
8 msg	Odd problem with OpenSSH
5 msg	[OT] fetchmail to procmail (or something) to ar...
1 msg	mozilla-firefox not finding plugins in /opt/net...
27 msg	Ext4 status - Alternative to ext2/3 for gentoo ...
6 msg	[OT] text editor with multiline block replacement
32 msg	reiser4 status

undelete files and dirs on ext3 partition
\ pat (15 Feb 2008)
. \ Neil Bothwick (15 Feb 2008)
. . \ Alan McKinnon (15 Feb 2008)
. . . \ pat (15 Feb 2008)
. . . . \ Alan McKinnon (15 Feb 2008)
. . . . \ Uwe Thiem (15 Feb 2008)
. . . . . \ Alex Schuster (15 Feb 2008)
. . . . . . \ pat (15 Feb 2008)
. \ Philip Webb (15 Feb 2008)

13 msg	MacBook: How many hours on battery with Gentoo?
1 msg	ooffice draw can't export to eps anymore
5 msg	Failing to build sane-backends
12 msg	Looking for PCI-X external SATA controller
9 msg	slightly OT, laptop for gentoo
3 msg	emerge ruby fails
1 msg	HP 530 experiences

Subject:	Re: undelete files and dirs on ext3 partition
Group:	Gentoo-user
From:	pat
Date:	15 Feb 2008

On Fri, 15 Feb 2008 12:01:25 +0100, Alex Schuster wrote
> Uwe Thiem writes:
>
> > On Friday 15 February 2008, pat wrote:
> > > On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote
> > >
> > > > Neil, you are a master of understatement :-)
> > > >
> > > > pat, it might be possible to get some stuff back, IF he remounted
> > > > ro immediately and IF not much writing to the disk happened in
> > > > the meantime.
> > > >
> > > > However, by the time you are done it is usually not worth the
> > > > effort it took. It's easier to reinstall and restore backups. But
> > > > if there are some irreplaceable files on that disk, you have no
> > > > choice. good luck to him.
> > >
> > > There's a home directory ... .
> >
> > What do you mean, Pat? /home still exists and is populated?
>
> I think he means there _was_ a /home directory.
>
> I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See <http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec> for a list of supported file types.
>
> There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu).
>
> I did not try it, but this tool sounds promising:
> http://freshmeat.net/projects/giis
>
> giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery.
>

Yes, there was the home directory.

Thanks to all for the help.

牋牋 Pat