[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ext3-users
Subject:    Re: low level search for deleted data
From:       "Theodore Ts'o" <tytso () mit ! edu>
Date:       2004-09-27 16:08:15
Message-ID: 20040927160815.GD15589 () thunk ! org
[Download RAW message or body]

On Sun, Sep 26, 2004 at 11:37:58PM +0200, andy13@gmx.net wrote:
> Hi everyone,
> 
> I lost my complete home directory and am facing the problem of retrieving
> some of the deleted data.
> I have search the web for this matter, but the only information I found is,
> that it's not possible for a program to do this and that I have to puzzle
> the files together by scanning the disk (or disk image) with tools like
> sleuthkit (www.sleuthkit.org) or lde (lde.sourceforge.net). That's ok, since
> the only files I like to recover are text files (c and java sourcecode). But
> even though I read the ext2-undelete-minihowto (which doesn't apply to ext3,
> I know) I honestly don't know how to start. The partition is 11GB and the
> data could be anywhere. Can anyone please describe a sensible approach to
> this task. I'm really helpless :(

If you have some specific text that you know was in a file that you're
trying recover, the followin gocmmand may be of use:

	grep -ab <regexp> /dev/hda1 | awk -F: '{printf("%d\n", ($1 + 4095) / 4096)}'

Replace <regexp> with the regular expression or string that you are
trying to find, and if the filesystem is using a 1k blocksize, replace
4095/4096 with 1023/1024.  This will given you block numbers which you
can then feed into lde.

Good luck!!

						- Ted


_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users
[prev in list] [next in list] [prev in thread] [next in thread]