Hello everybody, it happened with my RH73 that the same partition (ext3 fs, of course) was mounted onto two different mount points ( "/" and "/mnt/removable" respectively) and a copy of files from one path to another (e.g. "cp /opt/myfile /mnt/removable/opt) reveiled to be an overwriting procedure. Now I have 0 byte size files on /mnt/removable (aka "/") partition and I wonder whether is possible to retrieve - at least - parts of the data blocks. No one had access to the partition after (or during) the overwriting and the level of fragmentation is very low. I used lde tool to navigate through the flesystem looking for inodes (no way!) or block clues (jpeg tags, text strings, etc.) but I'm not very expert in this task... I have two questions for you: 1. do you think the data are still present somewhere in the disk? 2. Is in the world any procedure to allow to put all the pieces of the puzzle (I mean the data blocks) together again? I am available to give you further details to make it as much clear as possible. Thank you.
Hi, On Wed, 2003-02-12 at 10:46, Francesco Pirozzi wrote:> it happened with my RH73 that the same partition (ext3 fs, of course) was mounted > onto > two different mount points ( "/" and "/mnt/removable" respectively) and a copy of > files > from one path to another (e.g. "cp /opt/myfile /mnt/removable/opt) reveiled to be > an overwriting procedure. Now I have 0 byte size files on /mnt/removable (aka "/") > partition and I wonder whether is possible to retrieve - at least - parts of the > data blocks.> I have two questions for you: > 1. do you think the data are still present somewhere in the disk?Yes, it should be.> 2. Is in the world any procedure to allow to put all the pieces of the puzzle (I > mean the data > blocks) together again?Nothing other than manual hunting for the data with a tool like lde, I'm afraid (unless you've got a backup!) Cheers, Stephen
Francesco Pirozzi <francesco.pirozzi@accent.it> wrote:> > Hello everybody, > > it happened with my RH73 that the same partition (ext3 fs, of course) was mounted > onto > two different mount points ( "/" and "/mnt/removable" respectively) and a copy of > files > from one path to another (e.g. "cp /opt/myfile /mnt/removable/opt) reveiled to be > an overwriting procedure.Rather offtopic, but this should have generated an error cp: `/opt/myfile' and `/mnt/removable/opt/myfile' are the same file It does in 2.5... Or maybe you were using something other than `cp'?