[Ilugc] Undelete: impossible on ext3!

[Antano Solar John]

oh thanks i didnt know this difference exits between ext2 and ext3


>From: Kumaraguru <kums at gmx.net>
>To: Antano Solar John <solar345 at hotmail.com>
>CC: ilugc at ae.iitm.ac.in
>Subject: Re: [Ilugc] Undelete: impossible on ext3!
>Date: Mon, 21 Aug 2006 20:21:10 +0530
>
>No..no..no! this is not a Linux Vs Windows thing at all. You have 
>misunderstood me.. I think you missed the quote from ext3 developer that I 
>had given in my very first mail. For your convenience..here it is again 
>(from http://lkml.org/lkml/2003/1/7/135)
>
><quote>
>..in order to ensure that ext3 can safely resume an unlink after a
>crash, it actually zeros out the block pointers in the inode, whereas
>ext2 just marks these blocks as unused in the block bitmaps and marks
>the inode as "deleted" and leaves the block pointers alone.
>Your only hope is to "grep" for parts of your files that have been deleted 
>and hope for the best...
></quote>
>
>As he clearly explains, ext2 will maintain pointers to deleted blocks while 
>ext3 will not. That means, we know where the deleted blocks are and there's 
>a way we can differentiate them from the unused blocks that never had any 
>data before. fat32 has a similar way. So there is a logical possibility to 
>undelete. As ext3 doesn't maintain such pointers to deleted blocks, there's 
>no reliable way we can know where the deleted blocks are. I hope you see 
>the difference now.
>
>Another thing..if your ext3 partition is fragmented then you won't be able 
>to retrieve your file completely by reading the partition contiguously. One 
>part of your file may be in one place and another somewhere else.
>
>
>Antano Solar John wrote:
>>i am not sure how it is done but i think you can analyse overheads and 
>>know which is a mp3 which is a text file ......... or there is pattern and 
>>i think you can recognize the end of a file by the EOF character ......... 
>>if its possible in windows its possible in linux also just that one of us 
>>have to write a code and distribute it to the others :)
>>
>>
>>
>>>From: Kumaraguru <kums at gmx.net>
>>>To: ilugc at ae.iitm.ac.in
>>>Subject: Re: [Ilugc] Undelete: impossible on ext3!
>>>Date: Mon, 21 Aug 2006 10:53:42 +0530
>>>
>>>Yes, you are right - if they are not overwritten they are definitely 
>>>there.. but the problem is.. I won't exactly know where they are in my
>>>80 GB hard disk. I can try to recover some text files if I know some 
>>>unique words I had used in those files by grepping but if my files are 
>>>binary how would i know if, say.. "0F FF DE 6B 6E 73 76...." is a unique
>>>byte combination that occurs only in my lost mp3 file?
>>>
>>>I am learning the hard way. Don't forget to make your backups!
>>>
>>>Regards
>>>Kumaraguru
>>>--
>>>
>>>Antano Solar John wrote:
>>>>technically when u accidentally delete files , the data is not deleted 
>>>>only the link to it is deleted , so it must be possible to recover 
>>>>accidentially deleted data as long as it is not over written.
>>>>
>>>>
>>>>>From: "Binand Sethumadhavan" <binand at gmail.com>
>>>>>To: "Prashanth Mohan" <prashmohan at gmail.com>
>>>>>CC: Kumaraguru <kums at gmx.net>, ilugc at ae.iitm.ac.in
>>>>>Subject: Re: [Ilugc] Undelete: impossible on ext3!
>>>>>Date: Sun, 20 Aug 2006 13:22:37 +0200
>>>>>
>>>>>On 20/08/06, Prashanth Mohan <prashmohan at gmail.com> wrote:
>>>>>>IIRC I read some article on the net saying that Microsoft was planning
>>>>>>on shipping ``undelete'' as an option in their FSs (as part of Vista),
>>>>>>but then rolled it back due to security implications...
>>>>>
>>>>>It was privacy concerns primarily with some security thrown in. And it
>>>>>was generally, FUD - since the Recycle Bin provides approximately
>>>>>similar functionality (and there are several recycle bin
>>>>>implementations for Linux too).
>>>>>
>>>>>The System Restore feature is another "time-travel" feature in
>>>>>Windows. I believe Redhat has a similar feature for its high-end RHN
>>>>>subscribers (part of its provisioning module).
>>>>>
>>>>>http://arstechnica.com/news.ars/post/20060730-7383.html
>>>>>
>>>>>Binand
>>>
>>>_______________________________________________
>>>To unsubscribe, email ilugc-request at ae.iitm.ac.in with "unsubscribe 
>>><password> <address>"
>>>in the subject or body of the message.  
>>>http://www.ae.iitm.ac.in/mailman/listinfo/ilugc
>>
>>_________________________________________________________________
>>Live the life in style with MSN Lifestyle. Check out! 
>>http://content.msn.co.in/Lifestyle/Default
>>
>>
>
>_______________________________________________
>To unsubscribe, email ilugc-request at ae.iitm.ac.in with "unsubscribe 
><password> <address>"
>in the subject or body of the message.  
>http://www.ae.iitm.ac.in/mailman/listinfo/ilugc

_________________________________________________________________
Spice up your IM conversations. New, colorful and animated emoticons. Get 
chatting! http://server1.msn.co.in/SP05/emoticons/