restaurer données sous linux

ext3, reiserfs - journalling file systems
 
ext3 zeros indirect blocks...
 
List:     ext3-users
Subject:  data recovery openoffice.sx? on ext3-partition
From:     "i.t" i.t () ithum ! de
Date:     2002-09-04 8:06:42
 
since there have been undelete questions in the past, I'll shortly describe
how I've successfully recovered an openoffice spreadsheet on an ext3
partition:
 
1) umount the partition immediately after the accident
if possible dd to a safe place
 
2) debugfs or recover does NOT work; it will find only and always the same
zero size inode on the partition (my question to the developers: how about
backward compatibility; shouldn't there and for what time span the deleted
inodes available or are they immediately gone by journalling?)
 
3) use the block editor lde to find a typical string.
That was very hard for the openoffice spreadsheets since they start with "PK,
content.xml", the rest is binary until a short block arrives where you can
use the creation date as a search string (that's nearly all!)
 
4) I've written out blockwise, concatenated the blocks to a file, compared an
old backup file with an hex editor and edited with the hex editor  the last
block due to the original file end.
That was successful...

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.
 
Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.