Re: [PLUG] "unerase" for linux ext3?

[Eric <eric@lucii.org>]

JP Vossen wrote:
>> Date: Thu, 14 Feb 2008 09:48:15 -0500
>> From: Eric<eric@lucii.org>
>> Subject: [PLUG] "unerase" for linux ext3?
>>
>> I have a program that zero'ed out a file with some important data.
>> The file itself is still here but of zero byte length.
>>
>> Any way to recover that?
>
> I did that a year or two ago and spent a lot of time researching the
> issue.  At the time, there was no "good" way to do it.  All of the tools
> I found only work for ext2, and while you can trivially downgrade from
> ext3 to ext2, there is something about the ext3 journaling that
> basically makes it pointless.
>
> What I was able to do successfully was grep the raw device for strings I
> remembered from the file (Perl code).  Since my file was only a few
> hundred lines, "grep -C500 'string' /dev/hda1" or something like that
> worked.  Now when I say worked, it was ugly, but it got back enough to
> put the file back together.  Since then I've improved my backups and am
> a little more careful what I move where.
>
> If the file is binary, you are out of luck AFAIK.  I'd be delighted if
> someone could prove me wrong though.
>
> Good luck,
> JP

When I ran the grep command it told me that "binary file /dev/sdb2 matches" :-)

I need a command that finds the matching string and outputs the next block of 
characters to a file (on another device of course.).  Hummm  Perl comes to mind.


Thanks!
Eric
-- 
#  Eric Lucas
#
#                "Oh, I have slipped the surly bond of earth
#                 And danced the skies on laughter-silvered wings...
#                                        -- John Gillespie Magee Jr
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug