recovery files deleted in Linux

Nandex · 02-12-2004, 06:32 PM

hi all.
I have trouble getting a sotware to recovery deleted files in linux (ext2, ext3), if you know of some please , you can tell me, I'll be waiting your answers , thanks a lot.

spuzzzzzzz · 02-12-2004, 08:05 PM

If you delete a file using the command "rm", you can't recover it. If you are using gnome or kde and you delete a file by clicking on it and pressing "delete" then you can recover it by double clicking on the trash can on the desktop.

Kristijan · 02-12-2004, 09:58 PM

Not entirly true spuzzzzzzz. There are forms of data recovery that can recover deleted data. From my understanding, data is not deleted. It is only deleted when another chunk of data overwrites it.

With Nandex's case though, once the data is deleted, playing with application software and what not would most likely make the data harder to retreive. Not 100% on all this though, so don't go quoting me. I'm trying to remember from a talk at ruxcon last year.

http://www.ruxcon.org

spuzzzzzzz · 02-13-2004, 12:47 AM

From what I understand, the only thing actually deleted is the inode for the file. The data from the file is still there (unless something else tries to use that part of the disk) but the only way I could possibly imagine to recover it would involve knowing the exact position on the disk of the deleted file. If there is a different way, though, I would be extremely interested in knowing it.

hiteshmaisheri · 02-13-2004, 12:58 AM

is there any software that does the recovery for us???? Can anyone sugges some sofware on it????

Nandex · 02-13-2004, 12:14 PM

Hi all.
thanks for the answers, I was looking for some programs , and I find some here ,http://freshmeat.net/search/?q=delet...tion=projects, you can dowload this and prove it .
I proved some of this programs, but I didn't have luck, I think maybe because most of them is only for Ext2 and not Ext3,i find one that maybe function, the problem is that you have to know the blocks o inodes,it's a little to difficult to use, but I will try to find other one, tell me if you have better luck than me , ok?, Good luck.

aigartua · 02-13-2004, 04:16 PM

You can undelete manually.

Step 1: Stop write your hd,

Step 2: type

root#debugfs /dev/hda1

I suppose the file you want to recover is on /dev/hda1 .

Step 3:

debugfs:lsdel

list the file you delete recently.

pay more attention on file's inode,

debugfs:dump <file inode> yourhome

then you will find file in yourhome directory.

hiteshmaisheri · 02-14-2004, 12:12 AM

thanx for the help ... will check out the results of it...

Nandex · 02-14-2004, 04:22 PM

Thanks for the help too aigartua, I did that , but in the step3 (lsdel),
I get 0 inodes founded

, anyway , I'll try to find other solution, thanks
Greetings.