Re: Recovering deleted file by editing inode..

[Manish Katiyar <mkatiyar@xxxxxxxxx>]

On Wed, May 27, 2009 at 1:18 PM, Siddharth Chandra <kingsiddharth@xxxxxxxxx> wrote:

On Mon, May 25, 2009 at 9:04 AM, ranjith kannikara <ranjithkannikara@xxxxxxxxx> wrote:

Hi,
We are  a team of prefinal year computer science engineering students from kerala.We are trying to design an application which can recover deleted data from the ext3 filesystem. And we are doing it by editing the inode of the deleted file with the help of debugfs. As you told the 'modify_inode' in debugfs will be help ful we have written code to recover data . We could recover files of fairly larger size, we tried recovering files over 1Gb and we are sure to recover files of 4Gb in size if its not over-written.

But in the middle we are having little doubts and little problems in recovery. Like , after we recover the file,it appears in the disk as not accessible but when we unmout and remount the device the file is available. I shallbrief what we are doing, in the following lines. Please do go through it if you see it interesting. We have regestered the project in sourceforge and we will be uploading the code soon so that you can have your advices if you are interested.

* useing debugfs list the deleted files and their inode and select the file to be recovered.
* using logdump the details of the file inode,  journal entry, size, links , blockcount.
*if logdump yields a number of entries of none-zero size, the appropriate one is selected.
*then the inode is set using command 'seti'
*the inode is modified with the direct and indirect pointers which are taken from the journal.
*now the inode is linked to a file in name of the deletd one.

Here when the file is recovered it is appearing in the device but when we click on it, it will disappear but if the device is unmounted and remounted again, the file will behave as a usual file itself.
And if we ever delete a file which is recovered like this then all other files in the device will become read-only , untill it is remounted.

Regards,
Ranju.


--
http://www.ranjithkannikara.blogspot.com/

I once tried to do something similar and what I found out was that you cannot recover deleted data on ext3 filesystem. I guess, I read this in some ext3 specification by stephen tweedie, but I cannot find the link to it. There is another Link that I found : http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html .

Do let me know if I am wrong,

You can to some extent if you have that info in the journal. See the below link
http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

Thanks -
Manish

--
Siddharth

-- 
Thanks -
Manish