After a extensive search about a tool or method to undelete/recover files deleted from a partition whit the ext3 FS, i want to make some comments about the use of this FS. What are the benefits of use the ext3 FS in a system (server, desktop, etc.) if i cant recover files deleted by an intruder if i want need to make forensics; or if i want to recover important files deleted (business, personal use, a very important project, etc.) ?? Before i began using the ext3 FS, i read about the benefits of use it, but the online documentation about the ext3 FS dont say nothing about that its not possible undelete files. I was happy using the ext3 FS in my system before 1 week ago when i delete some files and dirs, where i have programs and docs of my work; and now i cant use them and cant recreate or rebuild. I read about umount my partition ( for what, ext3 FS clear the inodes), use lde, debufs, e2recover, etc ( this work only with ext2 FS), and some people saying that there is nothing to do. I use autopsy and task but dont work. Exist companies or people that can use ext3 FS in their linux systems and can survive if a file is deleted (if they dont have backups) or if they lost a very important project, or personal files. Or they use ext2 FS, preventing that they cant recover files?? This only thing make me think in change the security policy for my systems to use only ext2 FS until its posible to undelete or recover files. I hope you can understand what im traiying to say. -- LCC J. Manuel Lopez V. Network and System Administration FC/UABC _______________________________________________ Ext3-users@redhat.com https://listman.redhat.com/mailman/listinfo/ext3-users
