Thoughts on undeleting ext3 files

[Ron Goulard]

Since this has come up, I was wondering if anyone has any ideas about
recovering deleted files (short of going to the backups as not everyone
does them).  This probably doesn't strictly belong in this mailing list,
but I'll bring it up here since it can directly affect regular users. 
I'll take it off-list with any who are interested, if there are any
objections to it's being here.

In searching for an answer to Issa Rabba's dilemma about having deleted
/etc, I found the following message from a couple of years ago...

https://www.redhat.com/archives/ext3-users/2002-June/msg00031.html

and began wondering about the following hypothetical situation using
ext3fs.

If I were to use e2image on a daily basis to record the filesystem
metadata (and storing that on a different partition or machine for
example), how would I go about using this to get the data back?  I'm
guessing debugfs will help with this, but I must be more tired than I
thought because it's not jumping out at me.

The data from e2image is apparently quite compressible, sounds like
about 3-4M per 10G from the man page, so it should be rather easy to
implement something which might cover, say, a week's worth without
taking up too much disk space (depends on just how much disk space you
have of course).

I would think that this would be (could be?) faster at getting the data
back than breaking out the backups.  It certainly wouldn't be a
replacement for proper backups (and doesn't get around the user being
prepared for such things), but it may help with the odd 'one off'
deleted file retrievals.

Any thoughts?  Has somebody perhaps scripted or programmed something
which does this already?  If some part of the above isn't making sense,
just put it off to my being tired :)

Ron