[Ilugc] Undelete: impossible on ext3!
Antano Solar John
solar345 at hotmail.com
Mon Aug 21 15:00:00 IST 2006
oh thanks i didnt know this difference exits between ext2 and ext3
>From: Kumaraguru <kums at gmx.net>
>To: Antano Solar John <solar345 at hotmail.com>
>CC: ilugc at ae.iitm.ac.in
>Subject: Re: [Ilugc] Undelete: impossible on ext3!
>Date: Mon, 21 Aug 2006 20:21:10 +0530
>No..no..no! this is not a Linux Vs Windows thing at all. You have
>misunderstood me.. I think you missed the quote from ext3 developer that I
>had given in my very first mail. For your convenience..here it is again
>..in order to ensure that ext3 can safely resume an unlink after a
>crash, it actually zeros out the block pointers in the inode, whereas
>ext2 just marks these blocks as unused in the block bitmaps and marks
>the inode as "deleted" and leaves the block pointers alone.
>Your only hope is to "grep" for parts of your files that have been deleted
>and hope for the best...
>As he clearly explains, ext2 will maintain pointers to deleted blocks while
>ext3 will not. That means, we know where the deleted blocks are and there's
>a way we can differentiate them from the unused blocks that never had any
>data before. fat32 has a similar way. So there is a logical possibility to
>undelete. As ext3 doesn't maintain such pointers to deleted blocks, there's
>no reliable way we can know where the deleted blocks are. I hope you see
>the difference now.
>Another thing..if your ext3 partition is fragmented then you won't be able
>to retrieve your file completely by reading the partition contiguously. One
>part of your file may be in one place and another somewhere else.
>Antano Solar John wrote:
>>i am not sure how it is done but i think you can analyse overheads and
>>know which is a mp3 which is a text file ......... or there is pattern and
>>i think you can recognize the end of a file by the EOF character .........
>>if its possible in windows its possible in linux also just that one of us
>>have to write a code and distribute it to the others :)
>>>From: Kumaraguru <kums at gmx.net>
>>>To: ilugc at ae.iitm.ac.in
>>>Subject: Re: [Ilugc] Undelete: impossible on ext3!
>>>Date: Mon, 21 Aug 2006 10:53:42 +0530
>>>Yes, you are right - if they are not overwritten they are definitely
>>>there.. but the problem is.. I won't exactly know where they are in my
>>>80 GB hard disk. I can try to recover some text files if I know some
>>>unique words I had used in those files by grepping but if my files are
>>>binary how would i know if, say.. "0F FF DE 6B 6E 73 76...." is a unique
>>>byte combination that occurs only in my lost mp3 file?
>>>I am learning the hard way. Don't forget to make your backups!
>>>Antano Solar John wrote:
>>>>technically when u accidentally delete files , the data is not deleted
>>>>only the link to it is deleted , so it must be possible to recover
>>>>accidentially deleted data as long as it is not over written.
>>>>>From: "Binand Sethumadhavan" <binand at gmail.com>
>>>>>To: "Prashanth Mohan" <prashmohan at gmail.com>
>>>>>CC: Kumaraguru <kums at gmx.net>, ilugc at ae.iitm.ac.in
>>>>>Subject: Re: [Ilugc] Undelete: impossible on ext3!
>>>>>Date: Sun, 20 Aug 2006 13:22:37 +0200
>>>>>On 20/08/06, Prashanth Mohan <prashmohan at gmail.com> wrote:
>>>>>>IIRC I read some article on the net saying that Microsoft was planning
>>>>>>on shipping ``undelete'' as an option in their FSs (as part of Vista),
>>>>>>but then rolled it back due to security implications...
>>>>>It was privacy concerns primarily with some security thrown in. And it
>>>>>was generally, FUD - since the Recycle Bin provides approximately
>>>>>similar functionality (and there are several recycle bin
>>>>>implementations for Linux too).
>>>>>The System Restore feature is another "time-travel" feature in
>>>>>Windows. I believe Redhat has a similar feature for its high-end RHN
>>>>>subscribers (part of its provisioning module).
>>>To unsubscribe, email ilugc-request at ae.iitm.ac.in with "unsubscribe
>>>in the subject or body of the message.
>>Live the life in style with MSN Lifestyle. Check out!
>To unsubscribe, email ilugc-request at ae.iitm.ac.in with "unsubscribe
>in the subject or body of the message.
Spice up your IM conversations. New, colorful and animated emoticons. Get
More information about the ilugc