| Thursday July 24th 2014

Feedburner

Subscribe by email:

We promise not to spam/sell you.


Search Amazon deals:

HOWTO: Recover Deleted Files on an ext3 File System


tux-linux-penguin.jpg After a classic ‘rm -rf ~‘ on ext3, Carlo Wood succeeded in recovering most of his data. Here’s how… “It happens to everyone sooner or later: a split second after you hit Enter you realize your mistake, but it’s too late; you just deleted a valuable file or directory for which no backup exists. Or maybe you have a backup, but it’s a month old… and in shock you see the past month flash before your eyes as you realize in pain what you’ll have to do all over again…

Fortunately, you remember that files are never really deleted, at most overwritten by new content. So, you remount the disk read-only as fast as possible. But now?

If you Google for “undelete ext3″, almost every article you find will be users asking if it’s possible and the answer is every time: no.

The most frequently quoted passage comes from the ext3 FAQ itself:

Q: How can I recover (undelete) deleted files from my ext3 partition?

Actually, you can’t! This is what one of the developers, Andreas Dilger, said about it:

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as “deleted” and leaves the block pointers alone.

Your only hope is to “grep” for parts of your files that have been deleted and hope for the best.

Read on…

Related Posts: On this day...

Leave a Reply

You must be logged in to post a comment.