Jschiwals advice is really nice.
It is quite cool to see what
debugfs can do.
Am in middle of trying to recover a file automatically
deleted from the /tmp directory (my son -- who didn't
understand till now, not to be working in the /tmp directory)
Given /ext3 file system, I just get
Code:
0 deleted inodes found
.
As I've read elsewhere, if you delete in ext3 with
rm, or
your OS deletes for you, then you haven't got inodes to work with.
I tried to grep the whole file-system as follows
Code:
grep -a -i potter /dev/sda2
To find any occurence of Potter from Harry Potter on my /home partition.
If you are root -- this can be done but turns out non-productive. It seems for most of
the search strings I came up with that this just spits out lots and lots of gibberish.
Sometimes you can tell why the lines matched, other times they are a few thousand characters long
and the target doesn't even seem to appear on screen.
Further -- I was really trying to find the contents of an
.odt file, and those, of course,
are in some encoded binary format, so grepping for readable text does not work. If only
one identified in advance the file to be lost and saved it as ordinary text -- it would be better (grin).