recover files in ext3
 

hi, needs help to recover lost files in /home dir

i use RH 7.2 with ext3 type partition. I let my friends put their files on my server as backup under /home dir. One day i found out that the whole files & dirs under the /home dir is gone.. None!

I tried recover 1.3c and get this message:
Please enter the partition's device name /dev/ida/c0d0p7
Getting inodes (this can take some time)...
debugfs 1.23, 15-Aug-2001 for EXT2 FS 0.5b, 95/08/09
Segmentation fault

my partition info is this:
/dev/ida/c0d0p7 on / type ext3 (rw)
none on /proc type proc (rw)
/dev/ida/c0d0p3 on /boot type ext3 (rw)
none on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/ida/c0d0p5 on /usr type ext3 (rw)
/dev/ida/c0d0p8 on /var type ext3 (rw)

pls help anyone... thanks a lot..

This One day i found out that the whole files & dirs under the /home dir is gone. contradicts this: I let my friends put their files on my server as backup under /home dir., because if you gave them a user account, they should not be able to delete each others accounts. I haven't got a clue to say there's foul play, but you should investigate anyway especially if you're running network services on your system.

I'm not using LVM, so I can't comment on the effectiveness of recovery operations. Since ext3 is ext2 plus a journal all the same tricks apply like trying "mc"'s (aka the Midnight Commander) VFS undelete. If that fails please read "man debugfs" before continuing. Make sure you got enough free diskspace on another physical disk (that probably should not be part of the LV you're recovering from). In this example I'm using hdc1:

Show which inodes are unallocated:
echo lsdel | debugfs /dev/hdc1
Now generate the inode list:
echo lsdel | debugfs /dev/hdc1 2>&1| egrep -ve "(^debugfs|inodes found)" \
| cut -c1-6 | grep "[0-9]" | tr -d " " | sed 's/^.*$/stat <\0>/'

Here's some manual ops. Get statistics for a specific inode:
echo "stat <201>" | debugfs /dev/hdc1
Manually dump the contents of the inode:
echo "dump <201> /tmp/lost+found/201" | debugfs /dev/hdc1

Automated recovery looks like this:
echo lsdel | debugfs /dev/hdc1 2>&1| egrep -ve "(^debugfs|inodes found)" \
| cut -c1-6 | grep "[0-9]" | tr -d " "| while read inode; do
echo "stat <$inode>" | debugfs /dev/hdc1 2>&1> /tmp/lost+found/$inode.stat
echo "dump <$inode> /tmp/lost+found/$inode" | debugfs /dev/hdc1; done


Again, I know from experience this works on ext2, but I doubt this works on LV's: you'll have to determine which part of the LV the physical partition of /home resided on.

thanks...

to say foul's play.. I know that my friend would not dare to do such thing besides they only have user access.. it all started when I try connecting to the server from another machine using Absolute telnet... hmmm...

anyway, I just succesfully recovered all the files using R-Linux. Thank god I actually have Win NT partitions on my machine. So, i boot to NT, installed the R-Linux then voila.. it worked...

using R-linux, I put all the recovered files on another machine via network. R-linux is great.

And You did this with ext3 filesystem? I'm looking for such application for two weeks, but all i caould found was for ext2 undeletion - not for ext3 :(