[plug] undelete files in ext3 file system

[James Devenish]

In message <Pine.LNX.4.56.0309021300460.666 at cyllene.uwa.edu.au>
on Tue, Sep 02, 2003 at 01:08:36PM +0800, Denis Brown wrote:
> Hmmm... I was wondering about the utility of journalling for that purpose,
> too.

Note from <http://e2undel.sourceforge.net/how.html>:

"ext3 behaves differently: It deletes the block numbers in the inode; so
after deleting a file, you can't find its content from the inode
information."

By the sound of Jon's client's problem, the file modification dates are
not necessarily recent, so there is probably not an un-zeroed copy of
the inode in the journal.

This from the ext-3 FAQ:

'Q: How can I recover (undelete) deleted files from my ext3 partition?

Actually, you can't! This is what one of the developers, Andreas Dilger,
said about it:

In order to ensure that ext3 can safely resume an unlink after a crash,
it actually zeros out the block pointers in the inode, whereas ext2 just
marks these blocks as unused in the block bitmaps and marks the inode as
"deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been
deleted and hope for the best.'