gmureddu@xxxxxxxxxxxxxx:
> Lee Revell escribió:
> > On Sat, 2006-05-27 at 06:25 -0400, Ivica Ico Bukvic wrote:
> >
> >>> what about XFS? I am running XFS on my audio partions without any
> >>> problems...
> >>>
> >> I loved XFS until two things happened:
> >>
> >> 1) after accidentally doing rm -f on a particular file (too much typing
> >> makes my fingers slip, lol) I realized that there is no undelete/file
> >> recovery whatsoever
> >
> > Wow, ext3 has this?!?!? How do I use it?
> >
> > Lee
> >
> I think it is part of the e2fsprogs package (at least taht's the name in
> FC5). Plus I believe it is a feature of the FS as such, and using
> standard recovery tools you can undelete files and partitions.
No, does not seems so:
$ man e2undel 2>/dev/null | grep -A5 'To recove'
tion. To recover the data of a deleted file, you must completely rely
on the information in the inode like file size, owner, deletion time,
etc. ext3 behaves different from ext2 in one regard: When a file is
deleted, the information in the inode is also removed. Tools like
e2undel (or Ted T'so's debugfs(8)) that rely on this information when
undeleting files don't work anymore.
$
Both e2undel and recover say the same thing, with ext3 you are on your
own. And in this regared ext3 is no different than xfs. The way to
recover files left is to something similar to grep. This is what I did
(no, grep ... /dev/hda11 did not work wery well) to succesfully recover
some text files from a xfs partition (and yes, you must know what to
look for, in this case it started with the version string):
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#define BUFSZ 1024*1024*16
#define EXTRA 40000
char goal[] = "\\version \"2.9.0\"";
char buf[BUFSZ+EXTRA];
char nl[] = "\n";
int main(int argc, char * argv[]) {
size_t sz;
char *ptr;
char *sta;
int fd = open(argv[1], O_RDONLY);
int len = strlen(goal);
long long cnt = 0;
if (fd < 0) exit(1);
while (1) {
int avail;
sz = read(fd, buf, BUFSZ);
if (sz < 1) exit(3);
fprintf(stderr, "%16lld\r", cnt);
cnt+=sz;
sta = buf;
avail = sz;
while ( (ptr = (char *) memchr(sta, '\\', avail)) ) {
int tstlen = len;
sta = ptr+1;
avail = sz - (ptr-buf);
if (avail < tstlen) tstlen = avail;
if (!strncmp(goal, ptr, tstlen)) {
int plen = EXTRA;
if (plen > avail) plen = avail;
write(STDOUT_FILENO, ptr, plen);
write(STDOUT_FILENO, nl, 1);
}
}
}
return 0;
}
$ ./a.out /dev/hda11 | less
Happy hunting
/Karl
