I have recently released a project on sourceforge ( http://extundelete.sourceforge.net ) that can undelete a file from an ext3 or ext4 partition. It uses code from ext3grep to parse command-line options, and uses libext2fs to read the partitions. Instead of reading the entire partition, as ext3grep does, it reads only the journal file and is able to restore a deleted file from the information there and in (possibly deleted) directory blocks. I hope it is of some use. -N
On Thu, 30 Apr 2009, Number9652 wrote:> I have recently released a project on sourceforge > ( http://extundelete.sourceforge.net ) that can undelete a file from an > ext3 or ext4 partition. It uses code from ext3grep to parse > command-line options, and uses libext2fs to read the partitions. > Instead of reading the entire partition, as ext3grep does, it reads > only the journal file and is able to restore a deleted file from the > information there and in (possibly deleted) directory blocks. I hope it > is of some use.Thanks - I've added this to the collection of ext2/3 undeletion tools in the wiki: http://ext4.wiki.kernel.org/index.php/Undeletion Christian. -- Bruce Schneier once broke AES using nothing but six feet of rusty barbed wire, a toothpick, and the front axle from a 1962 Ford Falcon.
On Saturday 02 May 2009 19:00:14 ext3-users-request at redhat.com wrote:> have recently released a project on sourceforge > > > ( http://extundelete.sourceforge.net ) that can undelete a file from an > > ext3 or ext4 partition. It uses code from ext3grep to parse > > command-line options, and uses libext2fs to read the partitions. > > Instead of reading the entire partition, as ext3grep does, it reads > > only the journal file and is able to restore a deleted file from the > > information there and in (possibly deleted) directory blocks. I hope it > > is of some use. > > Thanks - I've added this to the collection of ext2/3 undeletion tools in > the wiki: http://ext4.wiki.kernel.org/index.php/UndeletionLook good. Never had much luck with ext3grep. However, cannot compile it. Has these huge hex constants that will not fit usual long types. Does this code need a 64-bit kernel or can I do something to the #defined I64 type to get this to compile?
On Thu, 30 Apr 2009, Number9652 wrote:> I have recently released a project on sourceforge > ( http://extundelete.sourceforge.net ) that can undelete a file from an > ext3 or ext4 partition. It uses code from ext3grep to parse > command-line options, and uses libext2fs to read the partitions.Hm, compiling with g++ 4.4 gave me a few compiling errors[0] - the patch attached "fixes" them, but when extundelete is actually used, it crashes: # ./extundelete /dev/md0 Running extundelete version 0.0.3 extundelete: extundelete.cc:894: void load_super_block(struct_ext2_filsys*): Assertion `(super_block.s_feature_compat & 0x0004)' failed. Aborted ...but maybe that has been caused by the patch. Hm. Christian. [0] http://nerdbynature.de/bits/extundelete/ -- All infinite sets are countable -- by Bruce Schneier. -------------- next part -------------- An embedded and charset-unspecified text was scrubbed... Name: extundelete_incl.diff.txt URL: <http://listman.redhat.com/archives/ext3-users/attachments/20090503/ba1b0905/attachment.txt>