After a classic ‘rm -rf ~‘ on ext3, Carlo Wood succeeded in recovering most of his data. Here’s how… “It happens to everyone sooner or later: a split second after you hit Enter you realize your mistake, but it’s too late; you just deleted a valuable file or directory for which no backup exists. Or maybe you have a backup, but it’s a month old… and in shock you see the past month flash before your eyes as you realize in pain what you’ll have to do all over again…

Fortunately, you remember that files are never really deleted, at most overwritten by new content. So, you remount the disk read-only as fast as possible. But now?

If you Google for “undelete ext3″, almost every article you find will be users asking if it’s possible and the answer is every time: no.

The most frequently quoted passage comes from the ext3 FAQ itself:

Q: How can I recover (undelete) deleted files from my ext3 partition?

Actually, you can’t! This is what one of the developers, Andreas Dilger, said about it:

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as “deleted” and leaves the block pointers alone.

Your only hope is to “grep” for parts of your files that have been deleted and hope for the best.

Read on…

Related Posts: On this day...

• Mariana Davalos: Maxim March 2011 - 2011
• Anonymous to release BofA dox - 2011
• TRON: The Next Day - Flynn Lives Revealed - 2011
• Iraqi Tron - 2011
• Teacher Writes "Loser" on Student's Paper - 2010
• Netflix Cancels $1 Million Contest, Settles Privacy Lawsuit - 2010
• HOWTO: Create a bootable self-playing video disc - 2009
• No User Action Required In Newly Discovered PDF Attack - 2009
• Hosted malware allows n00bs to hack along with the l33t - 2009
• Twitter Business Model Found - 2009