undeleting ext3 files
 

hi

I have Debian Sarge installed on ext3

by mistake I've deleted some important TEXT files

how I know, ext3 data structures do not support any method of undeleting

I've heard there is only a one posibbility using grep, but know someone how it works ?

kind regards
cccc

Basically, deleting a file in ext3 removes references to the file, but not the actual file. What you need to do is something like:

grep -a -C 40 -i "important document" /dev/hda > output.txt
The -a enables the binary /dev/hda file to be treated as text, the -C 40 gives 40 lines of context around the line you are searching for, the "important document" is a line that you remember from the document (in quotes), the /dev/hda is the location of the actual hard drive, and the > output.txt routes the output to a text file.

Adjust the options as needed.

As a final note, turn off the computer ASAP, and do all this via Knoppix (or similar) if at all possible. Any time a file will be written to the disk, there is a chance the important files will be overwritten. Also make sure the output file does not reside on the drive in question. (Knoppix home directory would be a good option.)

thanks !