Hi everyone, I lost my complete home directory and am facing the problem of retrieving some of the deleted data. I have search the web for this matter, but the only information I found is, that it's not possible for a program to do this and that I have to puzzle the files together by scanning the disk (or disk image) with tools like sleuthkit (www.sleuthkit.org) or lde (lde.sourceforge.net). That's ok, since the only files I like to recover are text files (c and java sourcecode). But even though I read the ext2-undelete-minihowto (which doesn't apply to ext3, I know) I honestly don't know how to start. The partition is 11GB and the data could be anywhere. Can anyone please describe a sensible approach to this task. I'm really helpless :( Thanks in advance Andreas -- GMX ProMail mit bestem Virenschutz http://www.gmx.net/de/go/mail +++ Empfehlung der Redaktion +++ Internet Professionell 10/04 +++
On Sunday 26 September 2004 23:37, andy13 at gmx.net wrote: i use debugfs for that purpose> Hi everyone, > > I lost my complete home directory and am facing the problem of retrieving > some of the deleted data. > I have search the web for this matter, but the only information I found is, > that it's not possible for a program to do this and that I have to puzzle > the files together by scanning the disk (or disk image) with tools like > sleuthkit (www.sleuthkit.org) or lde (lde.sourceforge.net). That's ok, > since the only files I like to recover are text files (c and java > sourcecode). But even though I read the ext2-undelete-minihowto (which > doesn't apply to ext3, I know) I honestly don't know how to start. The > partition is 11GB and the data could be anywhere. Can anyone please > describe a sensible approach to this task. I'm really helpless :( > > Thanks in advance > > Andreas-- e-admin internet gmbh Andreas Gietl tel +49 941 3810884 Ludwig-Thoma-Strasse 35 93051 Regensburg mobil +49 171 6070008 PGP/GPG-Key unter http://www.e-admin.de/gpg.html
On Sun, Sep 26, 2004 at 11:37:58PM +0200, andy13 at gmx.net wrote:> Hi everyone, > > I lost my complete home directory and am facing the problem of retrieving > some of the deleted data. > I have search the web for this matter, but the only information I found is, > that it's not possible for a program to do this and that I have to puzzle > the files together by scanning the disk (or disk image) with tools like > sleuthkit (www.sleuthkit.org) or lde (lde.sourceforge.net). That's ok, since > the only files I like to recover are text files (c and java sourcecode). But > even though I read the ext2-undelete-minihowto (which doesn't apply to ext3, > I know) I honestly don't know how to start. The partition is 11GB and the > data could be anywhere. Can anyone please describe a sensible approach to > this task. I'm really helpless :(If you have some specific text that you know was in a file that you're trying recover, the followin gocmmand may be of use: grep -ab <regexp> /dev/hda1 | awk -F: '{printf("%d\n", ($1 + 4095) / 4096)}' Replace <regexp> with the regular expression or string that you are trying to find, and if the filesystem is using a 1k blocksize, replace 4095/4096 with 1023/1024. This will given you block numbers which you can then feed into lde. Good luck!! - Ted