So I have done all sorts of research into recovering files on an ext3 file system, and since ext3 actually zeros-out inodes instead of flagging them like in ext2, the old undelete software is useless. Thus, I am turning to good ole grep to help me. I am doing the whole:

grep -a -B50 -A50 "search string" /dev/sda3

thing, and my problem is that grep takes up so much memory over time that it pukes. I can run top while running that grep command and see the available memory get smaller and smaller until there is virtually none left and grep pukes.

So, I have 256MB RAM and an 18GB HD. Is there a fix for this? Can I get grep to write it's temp data to another hard drive instead of the memory?

I think you answered your own question - a delete in ext3 zeroes out the markers instead of inactivating them, and as a result, that more or less kills any opportunity for an undelete. The grep option is basically a last resort, but perhaps you can boost your memory? I don't know if your budget/interest would validate going to 512Mg RAM or 1G RAM, but if the data is that important, you may be able to cost-justify the expense. Good luck with recovering the data. -- J.W.

you could try searching the disk in parts, something like the following to search 500M at a time:

dd if=/dev/sda3 bs=1048576 count=500 | grep ...
dd if=/dev/sda3 bs=1048576 skip=500 count=500 | grep ...