Linux Ext2fs Undeletion mini-HOWTO: Are there any tools to automate this process?

prev-5912015 next-8216540 toc-5035453

As it happens, there are. Unfortunately, I believe that they suffer from the same problem as the manual inode modification technique: indirect blocks are unrecoverable. However, given the likelihood that this will shortly no longer be a problem, it’s well worth looking these programs out now.

Someone on the net mentioned lde by Scott Heavner. To be honest, I wouldn’t recommend this as a tool for automating file recovery. It’s more like a full-screen debugfs than anything else, although it does have some features like the ability to scan for certain types of file or for certain file contents. It also works with the xia (does anyone actually use this any more?) and minix filesystems, which I guess is its major selling point these days. Version 2.3.4 is available on Sunsite and mirrors (although it’s possible there’s a more recent version than this; I found that one on an 8-month-old CD-ROM archive). lde does have some fairly useful documentation on basic filesystem concepts, as well as a document on how to use it for recovering deleted files. Although I haven’t used it, I suspect that my method above is better.

It sounds like the program that really works is the GNU Midnight Commander, mc. This is a full-screen file management tool, based AFAIK on a certain MS-DOS program commonly known as `NC’. mc supports the mouse on the Linux console and in an xterm, and provides virtual filesystems which allow tricks like cd-ing to a tarfile. Among its virtual filesystems is one for ext2 undeletion. It all sounds very handy, although I must admit I’ve never used the program myself — I prefer good old-fashioned shell commands. Apparently one must configure the program with the --with-ext2undel option; you’ll also need the development libraries and include files that come with the e2fsprogs package. I gather that once the program is built, you can tell it to cd undel:dev/hda5/, and get a `directory listing’ of deleted files.

READ  Linux Documentation Project Reviewer HOWTO

The latest non-development version is probably 4.0; as with the kernel itself, development versions are not recommended to non-hackers. The list of (over 70) download sites is available on the Midnight Commander 4 website, or try the official ftp site (which if memory serves is rather slow).

prev-5912015 next-8216540 toc-5035453