[ale] recovering an ext3 drive

[kaboom at gatech.edu (Chris Ricker)]

On Sun, 19 Jan 2003, ChangingLINKS.com wrote:

> By the way - Thank you (Geoffrey) for sending the information below. I am 
> putting it in my archive of commands so that I can use it later if needed.

One thing to keep in mind -- Geoffrey was on ext2. On ext3, you essentially
cannot undelete files, and certainly not by the method he outlined.

W/ ext2, deleting a file moves its inode to the free inode list and its
blocks to the free block list. It doesn't actually modify the contents of
the inode or the associated blocks.

W/ ext3, deleting a file moves its inode to the free inode list and its 
blocks to the free block list. It also zeros out the block pointers in the 
inode. As a result, the data's still (potentially) out there, but you have 
no way of locating it other than binary search through the free blocks 
for strings....

later,
chris
_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale