undelete data in ext3
 

hi, I accidentally delete a tar.gz file in my folder, anyone know how to undelete it? pleas help me...

The quick answer is "you can't". While ext2 has undelete programs available
they don't work on ext3. The long answer: if you have time, know the content
of the file (and rougly it's size) you may be able to locate it on the raw
device via grep and then output the sectors belonging to it to a new file...

Not a trivial task, though.



Cheers,
Tink

Just googled this up so no guarantees, warranties, etc,

http://sourceforge.net/projects/giis/

May help out next time.
Good luck. ;-)

You could try using photorec and narrowing the search down to tar files - but it will take you a good deal of time. Unless you really, really need the file back, it's hardly worth the effort.

Even on ext3, you can get it back if you want it bad enough. Normal ext2 recovery programs don't work well on ext3 because no inode data is available. But you can use abandoned block lists to find files that are longer than 12 blocks. (A block is usually 4096 bytes.) If your C skills are sharp and you need the file bad enough, your chances are good. Go to wikipedia and look up ext2; follow the external links. You will need /usr/include/linux/ext2_fs.h.

Your luck will be better if you do this before smearing the mud around on the filesystem in question.

Hope this helps.

testdisk
then you can copy the file recovered (if you are lucky , but looks done)

AFAIK, testdisk is used for recovering partitions, and that wasn't the OP's problem.

My wife tried photorec. On the first drive she tried, everything was recovered in pieces; not good for a .tgz file. On the second drive she tried, it got twisted into a weird loop, creating directory after directory with only one file in each: the same file.