JP Vossen on 14 Feb 2008 12:28:39 -0800

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] "unerase" for linux ext3?

> Date: Thu, 14 Feb 2008 09:48:15 -0500
> From: Eric <>
> Subject: [PLUG] "unerase" for linux ext3?
> I have a program that zero'ed out a file with some important data.
> The file itself is still here but of zero byte length.
> Any way to recover that?

I did that a year or two ago and spent a lot of time researching the 
issue.  At the time, there was no "good" way to do it.  All of the tools 
I found only work for ext2, and while you can trivially downgrade from 
ext3 to ext2, there is something about the ext3 journaling that 
basically makes it pointless.

What I was able to do successfully was grep the raw device for strings I 
remembered from the file (Perl code).  Since my file was only a few 
hundred lines, "grep -C500 'string' /dev/hda1" or something like that 
worked.  Now when I say worked, it was ugly, but it got back enough to 
put the file back together.  Since then I've improved my backups and am 
a little more careful what I move where.

If the file is binary, you are out of luck AFAIK.  I'd be delighted if 
someone could prove me wrong though.

Good luck,
JP Vossen, CISSP            |:::======|        jp{at}jpsdomain{dot}org
My Account, My Opinions     |=========|
Microsoft has single-handedly nullified Moore's Law.
Innate design flaws of Windows make a personal firewall, anti-virus
and anti-malware software mandatory. The resulting software arms race
has effectively flattened Moore's Law on hardware running Windows.
Philadelphia Linux Users Group         --
Announcements -
General Discussion  --