On Wed, May 27, 2009 at 1:18 PM, Siddharth Chandra <[email protected]>wrote:
> > > On Mon, May 25, 2009 at 9:04 AM, ranjith kannikara < > [email protected]> wrote: > >> >> Hi, >> We are a team of prefinal year computer science engineering students from >> kerala.We are trying to design an application which can recover deleted data >> from the ext3 filesystem. And we are doing it by editing the inode of the >> deleted file with the help of debugfs. As you told the 'modify_inode' in >> debugfs will be help ful we have written code to recover data . We could >> recover files of fairly larger size, we tried recovering files over 1Gb and >> we are sure to recover files of 4Gb in size if its not over-written. >> >> But in the middle we are having little doubts and little problems in >> recovery. Like , after we recover the file,it appears in the disk as not >> accessible but when we unmout and remount the device the file is available. >> I shallbrief what we are doing, in the following lines. Please do go through >> it if you see it interesting. We have regestered the project in sourceforge >> and we will be uploading the code soon so that you can have your advices if >> you are interested. >> >> * useing debugfs list the deleted files and their inode and select the >> file to be recovered. >> * using logdump the details of the file inode, journal entry, size, links >> , blockcount. >> *if logdump yields a number of entries of none-zero size, the appropriate >> one is selected. >> *then the inode is set using command 'seti' >> *the inode is modified with the direct and indirect pointers which are >> taken from the journal. >> *now the inode is linked to a file in name of the deletd one. >> >> Here when the file is recovered it is appearing in the device but when we >> click on it, it will disappear but if the device is unmounted and remounted >> again, the file will behave as a usual file itself. >> And if we ever delete a file which is recovered like this then all other >> files in the device will become read-only , untill it is remounted. >> >> Regards, >> Ranju. >> >> >> -- >> http://www.ranjithkannikara.blogspot.com/ >> > > > I once tried to do something similar and what I found out was that you > cannot recover deleted data on ext3 filesystem. I guess, I read this in some > ext3 specification by stephen tweedie, but I cannot find the link to it. > There is another Link that I found : > http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html . > > Do let me know if I am wrong, You can to some extent if you have that info in the journal. See the below link http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html Thanks - Manish > > > -- > Siddharth > -- Thanks - Manish
