Messages in this thread | | | Date | Tue, 7 Jan 2003 10:45:47 +0100 | From | Jan Hudec <> | Subject | Re: Undelete files on ext3 ?? |
| |
On Tue, Jan 07, 2003 at 10:29:06AM +0100, Maciej Soltysiak wrote: > > There is no simple way, no. > What about IDE Taskfile access, it's help says something like it's the > crown jewel of hard drive forensics. > > One question, how ext2/3 deletes files? similarily to fat by renaming the > first character?
No. By removing the directory entry completely and marking the inode unused.
By the way, there used to be undelete tool for ext2. It created a list of deleted inodes with correct stat, but no names, only their inode numbers. You could then pick the corect inode and give it a name, thus bringing it back to life. Since ext3 is just ext2 with journal, I guess it might work. It existed as a standalone tool and integrated to midnight commander.
------------------------------------------------------------------------------- Jan 'Bulb' Hudec <bulb@ucw.cz> - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |