On Sat, 2004-12-11 at 21:59 -0500, Matthew Cline wrote: > Hello, > > Basically, I deleted a bunch of files from a JFS partition accidentally, > and I was wondering if there was a way to undelete the data? I did > have backups of the most critical data, but I would like to recover > the other information. > > Once I realized my mistake, I immediately unmounted the JFS partition > in hope that something could be done. I don't have a very detailed > understanding of how the JFS filesystem operates, but I know that some > filesystems have an undelete mechanism. I had some ideas, but I don't > know if any of these are feasible: > > 1) use the JFS journal to roll back all transactions past a certain time > index?
It would be possible to do this in many cases, since a lot of the information you need can be reconstructed from the journal. It wouldn't be reliable in all cases, in that you would be able to reconstruct what disk blocks were allocated to a file, but I'm not how easily you could determine the logical file offset of these blocks. That information may still be available in the inode, but I'm not positive. I don't think there's any way to recover the size of the file (other than an estimate, based on where the last extent is). I think the directory entries may be recoverable in most cases, as long as more files weren't added to the directories after the deletes were done. > 2) alter the inodes of deleted files from "deleted" to "not-deleted"? > (I think this is how undelete utilities for other filesystems (such as > ext2) work.) The files are truncated as they are deleted, so only doing this would give you empty files (with no path to them). There might still be enough information in the inodes to reconstruct the xtree, but you'd have to determine the number of extents to try to recover, and wouldn't really have an accurate file size. > Any suggestions would be greatly appreciated. Thank you in advance. This is a year old, so I don't know if there has been any progress on this, but you may want to contact Knut and ask about the status of jfs support in sleuthkit: http://oss.software.ibm.com/pipermail/jfs-discussion/2003-December/001551.html -- David Kleikamp IBM Linux Technology Center _______________________________________________ Jfs-discussion mailing list [EMAIL PROTECTED] http://www-124.ibm.com/developerworks/oss/mailman/listinfo/jfs-discussion
