2009/5/14 david <[email protected]>: > Long story, but I have a photo that has been removed (rm file.jpg) on an > ext3 filesystem, Ubuntu 8.10 > > The hard drive is NOT the root drive and it has been unmounted and remounted > read only - <# mount -t ext3 -o ro /dev/sdb1 /mountpoint>. Nothing was > written on the drive as far as I know before unmounting. > > The obvious question: how to attempt recovery? I've stumbled on a thing > called ext3undel but it's not in the Ubuntu repositories, which made me > suspicious. > > There are lots of google comments saying "can't be done". > > What are my chances? any suggestions? Would be nice to have some success > stories before I try the wrong thing and mess things up.
I have had success in the past using autopsy/sleuthkit (http://www.sleuthkit.org) There's a slight learning curve, but it should be able to do what you ask if the data still exists. cheers, Owen. -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
