Eric on 14 Feb 2008 14:15:54 -0800

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] "unerase" for linux ext3?

JP Vossen wrote:
>> Date: Thu, 14 Feb 2008 09:48:15 -0500
>> From: Eric<>
>> Subject: [PLUG] "unerase" for linux ext3?
>> I have a program that zero'ed out a file with some important data.
>> The file itself is still here but of zero byte length.
>> Any way to recover that?
> I did that a year or two ago and spent a lot of time researching the
> issue.  At the time, there was no "good" way to do it.  All of the tools
> I found only work for ext2, and while you can trivially downgrade from
> ext3 to ext2, there is something about the ext3 journaling that
> basically makes it pointless.
> What I was able to do successfully was grep the raw device for strings I
> remembered from the file (Perl code).  Since my file was only a few
> hundred lines, "grep -C500 'string' /dev/hda1" or something like that
> worked.  Now when I say worked, it was ugly, but it got back enough to
> put the file back together.  Since then I've improved my backups and am
> a little more careful what I move where.
> If the file is binary, you are out of luck AFAIK.  I'd be delighted if
> someone could prove me wrong though.
> Good luck,
> JP

When I ran the grep command it told me that "binary file /dev/sdb2 matches" :-)

I need a command that finds the matching string and outputs the next block of 
characters to a file (on another device of course.).  Hummm  Perl comes to mind.

#  Eric Lucas
#                "Oh, I have slipped the surly bond of earth
#                 And danced the skies on laughter-silvered wings...
#                                        -- John Gillespie Magee Jr
Philadelphia Linux Users Group         --
Announcements -
General Discussion  --