Ext3 users - Feb 2004 - e2undel for ext3

Is there an ext3 version of this? Something in ext3 makes e2undel unable to 
recover unlinked inodes. I just deleted something, umounted the drive to 
preserve the state. I used e2undel to look for stuff to recover and it found 
0 deleted files.

I have been using e2undel for quite a while with great success and I know hwo 
to use it, but it seems to not be able to recover stuff on ext3. Is there a 
difference in the superblock structure the way ext3 unlinks files? I am sure 
they are there still obviously.

I don't "need" these files, but I would be VERY upset to loose
them.

-- 
Scot Mc Pherson <scot@linuxfromscratch.org>
http://linuxfromscratch.org/~scot/
Usenet Server Admin, IRCop, RPM Maintainer
ICQ: 342949
AIM: ScotLFS
MSN: behomet@earthlink.net

On Tue, Feb 03, 2004 at 04:51:43PM -0500, Scot Mc Pherson
wrote:
> I don't "need" these files, but I would be VERY upset to
loose them.
You'll have to go over your drive block by block to reconstruct your data
then.

Ext3 truncates before unlinking because of the journaling.

I'd love it if someone found a way to allow undelete in ext3.  Any ideas?

Other than that, you should look at a userspace solution like libtrash.

Mike

On Feb 03, 2004  16:51 -0500, Scot Mc Pherson wrote:
> Is there an ext3 version of this? Something in ext3 makes e2undel unable to
> recover unlinked inodes. I just deleted something, umounted the drive to 
> preserve the state. I used e2undel to look for stuff to recover and it
found
> 0 deleted files.
> 
> I have been using e2undel for quite a while with great success and I know
hwo
> to use it, but it seems to not be able to recover stuff on ext3. Is there a
> difference in the superblock structure the way ext3 unlinks files? I am
sure
> they are there still obviously.
Unfortunately, yes, there is a difference in the way that ext3 operates that
prevents e2undel from working.  This is required to ensure that if ext3
crashes during an unlink that you don't lose space in the filesystem,
because
there is no full fsck run at boot.
> I don't "need" these files, but I would be VERY upset to
loose them.
Depending on the content/size of the files, you may be able to recover them
by using e.g. "strings -tx /dev/foo" to search for keywords if text
files
were deleted, or possibly some custom code to search for binary values like
magic numbers.

Cheers, Andreas
--
Andreas Dilger
http://sourceforge.net/projects/ext2resize/
http://www-mddsp.enel.ucalgary.ca/People/adilger/