Linux Ext2fs Undeletion mini-HOWTO: Preparing to change inodes directly

prev-5108730 next-6943200 toc-7066660

My advice? Don’t do it this way. I really don’t think it’s wise to play with a filesystem at a low enough level for this to work. There are also has problems in that you can only reliably recover the first 12 blocks of each file. So if you have any long files to recover, you’ll have to use the other method anyway. (Although see section Will this get easier in future? for additional information.)

If you feel you must do it this way, my advice is to copy the raw partition data to an image on a different partition, and then mount this using loopback:

# cp /dev/hda5 /root/working
# mount -t ext2 -o loop /root/working /mnt

This does, however, require a recent version of mount. (Although you should get version 2.6 or newer anyway, as all earlier versions have a major security bug which allows peons to get root access. The major distributions, that is, Debian, RedHat and Slackware, have all been updated with version 2.6 of mount.)

Using loopback means that when you completely destroy the filesystem (as you quite possibly will), all you have to do is copy the raw partition back and start again.

prev-5108730 next-6943200 toc-7066660

READ  The Linux Documentation Project (LDP) Manifesto