On Mon, Feb 18, 2002 at 10:41:27PM +0100, NovaLand wrote: > Recently I've encountered a problem, and now I would preciate any help > about being able to undelete files. > > My /var filestructured is mounted at /dev/hdc1 > Part of my /etc/mtab looks like this: > /dev/hdc1 /var ext3 rw 0 0 > > I'm using the e2fsprogs-1.23-2 package currently installed with Redhat 7.2 > > So, could anyone give me a hint of how things could be done to find > deleted inodes? > > I've tried to use debugfs , but I suspect this only helps if I'm using > ext2. Or does they support ext3 too? You can use debugfs, but unfortunately, the way ext3 works the allocated blocks in the deleted inodes get zapped when the inode is deleted, unlike in ext2. This means that the recovery tricks that work when the filesystem is mounted as ext2 don't work under ext3. It would be really nice to fix this, but It Would Be Hard. I'm thinking about ways in which the data saved by e2image could be used to recover deleted files (assuming that the filesystem metadata is regularly being backed up via e2image), but while it oculd be done, it's a Mere Matter of Programming that hasn't been done yet. And in any case, it won't be able to recover the filename -> inode number mapping information. (You could save that information using e2image -r, but that's a fairly slow and painful operation.) - Ted
