On Thu, Aug 07, 2003 at 03:09:06PM -0400 West, William M wrote:
> >While I'm still off topic and speaking of data recovery, has anyone
> >every recovered data from a ext3 filesystem after all utilities have
> >been tried to repair them? I've tried all the utilities off of
> >freshmeat.net and nothing works. I've got bad blocks and i-nodes. Any
> >suggestions are welcome and you can email me off list.
>
>
> as i had mentioned yesterday, i had written a script some time ago that
> dealt a little with this. i have since found it (or a version of it) in
> dead tree form- so i retyped it and am sure there are several things wrong
> with it.
>
> i am not sure what all the components do anymore- i did not document it well
> :P
Let me help. :-)
> now that i've looked at it, it's really for getting to files that are
> unlinked etc..... so i am not sure it will do you any good.
Partly it might. The only problem with your script is that it cannot
deal with data that is spanning more than 12 inodes (those were usually
not in one block but fragmented over the harddisk). A line like this
shows such a trickier example:
99526 0 100644 676132 1/1027 Sat Feb 2 09:11:58 2002
I don't by hard know what to do with it, but it is laid out in the ext2
undeletion how-to.
> to bring this more on topic, i would like to see what ways something like
> this can be improved- it served useful to me in the past, but i'm sure it
> can be made more useful:::
>
>
> #!/usr/bin/perl
>
> # added proper things when retyping it:
> use warnings;
> use diagnostics;
> use strict;
> #-------------------
>
> my $cfile = "/tmp/commands.file";
> my $filesystem ="/dev/hda6";
> my @path = ("/tmp/recover","","/recover","",".ebu"); #making a path to put
> my $date="Oct"; #just files from October #stuff later
>
> open (OUT,">$cfile");
> print OUT "open $filesystem\n";# i wonder what this is for?
Debug message?
> foreach (`/sbin/debugfs -R lsdel /dev/hda6`){#why did i hard code /dev/hda6?
>
> #debugfs let's me list a bunch of inodes and i stick the list in a file
>
> m/(\d+)/;
> $path[3]=$1; #had to split this regex to dead with some edge case
> $1=~m/(\d)/; # but i can't recall what....
>
> $path[1]=$1;
> my $quatch = join("",@path);
> my $place= "path[0]$path[1]";
> print OUT("dump <$path[3]> $quatch\n") if ((m/$date/));
Essentially, from a line like
2210070 1000 100600 22843 2/ 6 Wed Jul 23 09:26:10 2003
you extract the inode (2210070) and from that turn
my @path = ("/tmp/recover","","/recover","",".ebu");
into
@path = ("/tmp/removed", 2, "/recover", 2210070, ".ebu");
So the deleted inode gets dumped into
/tmp/removed/2/recover/2210070.ebu
This could have been done more easily:
@path[3,1] = /((\d)\d+)/;
> `mkdir $place`;
> }
>
>
> -----------------
>
> then i chmod 755 command.file? or is it a file used by another tool???
command.file is the list of dump directives. It's supposedly a shell
script that you can run later. So the above Perl script just generates
another script. I am just not sure about
> print OUT "open $filesystem\n";
open /dev/hda6
is not a meaningful command in shell scripts AFAIK.
Tassilo
--
$_=q#",}])!JAPH!qq(tsuJ[{@"tnirp}3..0}_$;//::niam/s~=)]3[))_$-3(rellac(=_$({
pam{rekcahbus})(rekcah{lrePbus})(lreP{rehtonabus})!JAPH!qq(rehtona{tsuJbus#;
$_=reverse,s+(?<=sub).+q#q!'"qq.\t$&."'!#+sexisexiixesixeseg;y~\n~~dddd;eval
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
