[lkml]   [2003]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Undelete files on ext3 ??
On Tue, Jan 07, 2003 at 10:29:06AM +0100, Maciej Soltysiak wrote:
> > There is no simple way, no.
> What about IDE Taskfile access, it's help says something like it's the
> crown jewel of hard drive forensics.
> One question, how ext2/3 deletes files? similarily to fat by renaming the
> first character?

No. By removing the directory entry completely and marking the inode

By the way, there used to be undelete tool for ext2. It created a list
of deleted inodes with correct stat, but no names, only their inode
numbers. You could then pick the corect inode and give it a name, thus
bringing it back to life. Since ext3 is just ext2 with journal, I guess
it might work. It existed as a standalone tool and integrated to
midnight commander.

Jan 'Bulb' Hudec <>
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:32    [W:0.107 / U:1.896 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site