A new use for Linux

[Manuel Arostegui Ramirez]

El Jueves, 19 de Julio de 2007 22:39, Rick Stevens escribió:
> On Thu, 2007-07-19 at 15:26 -0500, Aaron Konstam wrote:
> > On Thu, 2007-07-19 at 11:57 -0800, Bazooka Joe wrote:
> > > Are there any tools for recovering files in ext3 file system?
>
> ext3 is ext2 with a journal.  My guess is that an ext2 tool should be
> able to deal with it.
>

Because of the journal it doesn't :-)
Quoteing from the web I posted in a previus email

" Several things occur when an Ext3 file is deleted from Linux. Keep in mind 
that the OS gets to choose exactly what occurs when a file is deleted and 
this article assumes a general Linux system.

At a minimum, the OS must mark each of the blocks, the inode, and the 
directory entry as unallocated so that later files can use them. This minimal 
approach is what occurred several years ago with the Ext2 file system. In 
this case, the recovery process was relatively simple because the inode still 
contained the block addresses for the file content and tools such as debugfs 
and e2undel could easily re-create the file. This worked as long as the 
blocks had not been allocated to a new file and the original content was not 
overwritten.

With Ext3, there is an additional step that makes recovery much more 
difficult. When the blocks are unallocated, the file size and block addresses 
in the inode are cleared; therefore we can no longer determine where the file 
content was located. We can see the relationship between the directory entry, 
the inode, and the blocks of an unallocated file in Figure 2"

Cheers
Manuel
-- 
Manuel Arostegui Ramirez.

Electronic Mail is not secure, may not be read every day, and should not
be used for urgent or sensitive issues.