On Saturday 28 October 2006 11:36, Matthew Stringer wrote:
Hi
I've an old server with a single SCSI disk which a disgruntled techie has rm -Rf * from the root of the drive.
The backup has been trashed too.
Is there any way to restore not only the files but the directory tree?
Googling I read that doing this on the ext3 FS is impossible yet I've seen various Windows based pieces of software that claim to be able to restore no idea why they run on Windows and not Linux though?!
What's the chances of a resoration and is there something that I can run under Linux that will do it?
ext3 is worse than ext2 in this respect. ext2 just marks a block as unused, but ext3 actively overwrites the pointer. This means undelete in ext2 is just a question of resetting the block to "used", but in ext3 you have to perform some detective work, finding your file data on the disk, and then traversing the linked list of blocks backwards and forwards until you find the beginning and end, and then marking each block as used, and creating a pointer to the start in an inode Needless to say, this isn't trivial, and relies on finding the file data in the first place. With binary files, this can be difficult You might be able to get results using The sleuth kit. I've never tried it myself, so I couldn't say much about it, but other undelete tools recommend it http://www.sleuthkit.org/sleuthkit/