undeleting ext3 files
hi
I have Debian Sarge installed on ext3 by mistake I've deleted some important TEXT files how I know, ext3 data structures do not support any method of undeleting I've heard there is only a one posibbility using grep, but know someone how it works ? kind regards cccc |
Basically, deleting a file in ext3 removes references to the file, but not the actual file. What you need to do is something like:
grep -a -C 40 -i "important document" /dev/hda > output.txt The -a enables the binary /dev/hda file to be treated as text, the -C 40 gives 40 lines of context around the line you are searching for, the "important document" is a line that you remember from the document (in quotes), the /dev/hda is the location of the actual hard drive, and the > output.txt routes the output to a text file. Adjust the options as needed. As a final note, turn off the computer ASAP, and do all this via Knoppix (or similar) if at all possible. Any time a file will be written to the disk, there is a chance the important files will be overwritten. Also make sure the output file does not reside on the drive in question. (Knoppix home directory would be a good option.) |
thanks !
|
All times are GMT -5. The time now is 12:55 AM. |