Re: [PLUG] "unerase" for linux ext3?

[JP Vossen <jp@jpsdomain.org>]

> Date: Thu, 14 Feb 2008 09:48:15 -0500
> From: Eric <eric@lucii.org>
> Subject: [PLUG] "unerase" for linux ext3?
> 
> I have a program that zero'ed out a file with some important data.
> The file itself is still here but of zero byte length.
> 
> Any way to recover that?

I did that a year or two ago and spent a lot of time researching the 
issue.  At the time, there was no "good" way to do it.  All of the tools 
I found only work for ext2, and while you can trivially downgrade from 
ext3 to ext2, there is something about the ext3 journaling that 
basically makes it pointless.

What I was able to do successfully was grep the raw device for strings I 
remembered from the file (Perl code).  Since my file was only a few 
hundred lines, "grep -C500 'string' /dev/hda1" or something like that 
worked.  Now when I say worked, it was ugly, but it got back enough to 
put the file back together.  Since then I've improved my backups and am 
a little more careful what I move where.

If the file is binary, you are out of luck AFAIK.  I'd be delighted if 
someone could prove me wrong though.

Good luck,
JP
----------------------------|:::======|-------------------------------
JP Vossen, CISSP            |:::======|        jp{at}jpsdomain{dot}org
My Account, My Opinions     |=========|      http://www.jpsdomain.org/
----------------------------|=========|-------------------------------
Microsoft has single-handedly nullified Moore's Law.
Innate design flaws of Windows make a personal firewall, anti-virus
and anti-malware software mandatory. The resulting software arms race
has effectively flattened Moore's Law on hardware running Windows.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug