[vox-tech] info about undeleting files

[Peter Jay Salzman]

--sm4nu43k4a2Rpi4c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

hi all,

i just came across information that might be useful to some of you.

i've always been smug about undeleting files.  i've read the undeletion
howto many times and know the intimate details about inodes,
superblocks, files and directories under ext2.

i've also been very smug in my knowledge of GNU make, but today i made
an awful, awful blunder:

   PROGS =3D $(patsubst %.c, %, $(wildcard *.c))
   CFLAGS =3D -W -Wall -g
   LDLIBS =3D -lncurses
  =20
   all: $(PROGS)
  =20
   .PHONY: clean
  =20
   clean:
      rm -rf *.c core $(PROGS)

can you feel my pain yet?

well, no problem.  i unmounted /home and started to collect the deleted
inodes:

   satan# fuser -k -m /dev/hda7
   satan# mount -o remount,ro /dev/hda7
   satan# debugfs /dev/hda7
   debugfs 1.33 (21-Apr-2003)
   debugfs:  lsdel
    Inode  Owner  Mode    Size    Blocks   Time deleted
   0 deleted inodes found.

that's wierd.  i should've gotten hundreds of deleted inodes.  what's up
with that?

after a bit of searching, i found this in the e2undel README:

   ext3 behaves different from ext2 in one regard: When a file is
   deleted, the information in the inode is also removed. Tools like
   e2undel (or Ted T'so's debugfs) that rely on this information when
   undeleting files don't work anymore.

jumpin jehosephat.  i never knew this.  i guess this is why it's called
the "ext2fs undeletion howto", emphasis on the "2".

well, the program was very short and i recreated it in a few minutes, so
that's not a problem at all.

but the fact that ext3 inodes are removed when you delete a file is big
news to me, and caught me by surprise.

i figured i'd share this info, since i know some of you know how to
recover files by hand also.

pete

--=20
GPG Instructions: http://www.dirac.org/linux/gpg
GPG Fingerprint: B9F1 6CF3 47C4 7CD8 D33E 70A9 A3B9 1945 67EA 951D

--sm4nu43k4a2Rpi4c
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+ymnbo7kZRWfqlR0RAv3vAJ9ri9wmM6O/ShENdIWgOm3DGRTtDwCfXTwa
L6GepfEFEyvDpKvciNlL8f0=
=oa7h
-----END PGP SIGNATURE-----

--sm4nu43k4a2Rpi4c--