[plug] undelete files in ext3 file system

[James Devenish]

In message <Pine.LNX.4.56.0309021300460.666 at cyllene.uwa.edu.au>
on Tue, Sep 02, 2003 at 01:08:36PM +0800, Denis Brown wrote:
> Hmmm... I was wondering about the utility of journalling for that purpose,
> too.  I suppose that as others have mentioned, it would be a case of
> first-in best-dressed.  If the file system had been written to after the
> "Oops", that file space may have already been overwritten.

Pure speculation...if the ext3 journalling system uses some pre-
allocated blocks for the journal, and were to use them in perhaps a
"round robin" fashion rather than "first available", the chances of
finding the old journal data could be quite high.

> Is there the equivalent of the "Trash" bin or "Recycle" bin (MAC / PC
> respectively) concept in Linux for giving one extra level of "Oh, I really
> didn't mean that!" security.

As with those operating systems, the "Trash" or "Recycle Bin" concept is
a "filer" feature, not a filesytem or OS feature. As you alluded to, the
filers for most desktop managers will provide such a feature.

> Not much help in a server environment, agreed, but would make the
> up-take of Linux more pleasant to the general populace.

The -i option to GNU rm could help you, but you would need to be in the
habit of specifying it every time you use rm (you could set up a shell
alias so that you didn't have to specify -i all the time, but that could
lead you to assume that -i is always being used). But this wouldn't
protect you from accidental overwrites. As someone who doesn't hack
filesystems, I would have thought some filesystems might, say, keep a
list of the most recently unlinked inodes (say, the last 1024), and not
let re-use those inodes under normal circumstances. But then,...the
blocks on disk might get overwritten anyway.