Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2416
  • Last Modified:

is it possible to undelete files from Linux EXT3?.

Dear sir,
i want to recover file from ext3 partition,is it possible to recover files using journal?
waiting for your reply
Thanks  
0
davinder101
Asked:
davinder101
3 Solutions
 
pavaneeshkumarCommented:
it is really painfull to recover files in ext 3.

Have a look on this article hope this will help.

http://linux.sys-con.com/read/117909.htm
http://linux.sys-con.com/read/117909_2.htm
0
 
ibu1Commented:
In order to ensure that ext3 can safely resume an unlink after a crash,
it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks
the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been
deleted and hope for the best.
0
 
davinder101Author Commented:
thanks for your suggestions,
  sir,i am providing some useful information which might  help you to guide me.
   in journal data structure,all the updations are recorded in descriptor of journal with their sequence no.
   we can get the inode no. from directory entry,it will give us the related block group
   in which that inode table resides,finally we can find out the corresponding block no.
   in journall there would many references to that block,
   but how can i get  the  reference which gives the previous inode entry of deleted file.
   Thanks
0
Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

 
TintinCommented:
As already mentioned, it's going to be tricky.  One thing you may want to consider in the future (apart from having good backups) is using GIIS.

http://sourceforge.net/projects/giis/
0
 
davinder101Author Commented:
i have accidentally deleted some files,but i did not install GIIS(in GIIS it would not recover the files which have been deleted before its installation)
how can i recover those files?
0
 
pavaneeshkumarCommented:
did you checked links posted before.
In your case this is the only way to recover deleted filed.

http://linux.sys-con.com/read/117909.htm
http://linux.sys-con.com/read/117909_2.htm

0
 
davinder101Author Commented:
ok,what wre the steps to recover files in ext3,using debugfs?
is it recover all types of files?
0
 
pavaneeshkumarCommented:
what wre the steps to recover files in ext3,using debugfs?
             steps are already given in the article.

is it recover all types of files?
            yes .
0
 
davinder101Author Commented:
sir,i followed the steps of journal based recovery
the output is given below

debugfs:logdump -i <12>
inode 12 is at group 0,block 0,offset 4580
journal starts at block 0,transaction 125

but it did not show the block pointers of inode 12
where am i going wrong?
is this method recovers files which have not  been deleted recently?

0
 
emadmohCommented:
i have the same problem , some of my files are deleted , i tried to install recovery data for linux from recoverytools.com , but it's not working , and i when i tried the debugfs command , i got a message can't open file system , all my data are stored on SAN Storage  , any way to recover please , Help
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now