I was fooled by a hard link trying to clean up disk space.
How can I undelete many files? (time is of the essence as I cannot unmount the partition)
-- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - - - Jason Pyeron PD Inc. http://www.pdinc.us - - Principal Consultant 10 West 24th Street #100 - - +1 (443) 269-1555 x333 Baltimore, Maryland 21218 - - - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This message is copyright PD Inc, subject to license 20080407P00.
-----Original Message----- From: Jason Pyeron Sent: Thursday, August 12, 2010 17:22 To: 'CentOS mailing list' Subject: [CentOS] Ext3 undelete
I was fooled by a hard link trying to clean up disk space.
How can I undelete many files? (time is of the essence as I
I guess I can release the lvm snapshot...
cannot unmount the partition)
This directory was too big to backup, http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html says I am SOL if I don't know the contents to grep for it...
Oh well.
-- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - - - Jason Pyeron PD Inc. http://www.pdinc.us - - Principal Consultant 10 West 24th Street #100 - - +1 (443) 269-1555 x333 Baltimore, Maryland 21218 - - - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This message is copyright PD Inc, subject to license 20080407P00.
Google is you friend..
http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html
Good luck!
-- Don Krause Head Systems Geek, Waver of Deceased Chickens. Optivus Proton Therapy, Inc. P.O. Box 608 Loma Linda, California 92354 909.799.8327 Tel 909.799.8366 Fax dkrause@optivus.com www.optivus.com "This message represents the official view of the voices in my head."
On Thu, Aug 12, 2010 at 02:26:00PM -0700, Don Krause wrote:
That's an excellent little program. It can take some mucking about to find the invocation that will save a particular file or set of files, but it often can get the job done. It's well supported on its mailing list too.
Whit
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Whit Blauvelt Sent: Thursday, August 12, 2010 17:31 To: CentOS mailing list Subject: Re: [CentOS] Ext3 undelete
On Thu, Aug 12, 2010 at 02:26:00PM -0700, Don Krause wrote:
That's an excellent little program. It can take some mucking about to find the invocation that will save a particular file or set of files, but it often can get the job done. It's well supported on its mailing list too.
Now the question is will it complete before more than the 100M snapshot is used up...
[root@host67 tmp]# ext3grep $IMAGE --restore-all --after=1281653802 --before=1281656202 Running ext3grep version 0.10.2 Only show/process deleted entries if they are deleted on or after Thu Aug 12 18:56:42 2010 and before Thu Aug 12 19:36:42 2010.
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state. Number of groups: 1846 Minimum / maximum journal block: 1545 / 9747 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1281635206 = Thu Aug 12 13:46:46 2010 Journal transaction 16090037 wraps around, some data blocks might have been lost of this transaction. Number of descriptors in journal: 7101; min / max sequence numbers: 16089433 / 16090473 Writing output to directory RESTORED_FILES/ Finding all blocks that might be directories. D: block containing directory start, d: block containing more directory entries. Each plus represents a directory start that references the same inode as a directory start that we found previously.
Searching group 0: DDDDDDDD+DD+++D+++D++++D+++D++++DD++DDD+DddDDDddDdD+Dddddddddddddddddddddddddddd ddddddddddddddddddddddddddddddd
Thanks everyone...
-- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - - - Jason Pyeron PD Inc. http://www.pdinc.us - - Principal Consultant 10 West 24th Street #100 - - +1 (443) 269-1555 x333 Baltimore, Maryland 21218 - - - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This message is copyright PD Inc, subject to license 20080407P00.
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Jason Pyeron Sent: Thursday, August 12, 2010 17:41 To: 'CentOS mailing list' Subject: Re: [CentOS] Ext3 undelete
-----Original Message----- From: centos-bounces@centos.org [mailto:centos-bounces@centos.org] On Behalf Of Whit Blauvelt Sent: Thursday, August 12, 2010 17:31 To: CentOS mailing list Subject: Re: [CentOS] Ext3 undelete
On Thu, Aug 12, 2010 at 02:26:00PM -0700, Don Krause wrote:
That's an excellent little program. It can take some
mucking about to
find the invocation that will save a particular file or set
of files,
but it often can get the job done. It's well supported on
its mailing
list too.
Now the question is will it complete before more than the 100M snapshot is used up...
Searching group 1768: ext3grep: get_block.cc:37: unsigned char* get_block(int, unsigned char*): Assertion `device.good()' failed.
Disk filled up... Good by files...
[root@host67 tmp]# ext3grep $IMAGE --restore-all --after=1281653802 --before=1281656202 Running ext3grep version 0.10.2 Only show/process deleted entries if they are deleted on or after Thu Aug 12 18:56:42 2010 and before Thu Aug 12 19:36:42 2010.
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is. WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either means that your partition is still mounted, and/or the file system is in an unclean state. Number of groups: 1846 Minimum / maximum journal block: 1545 / 9747 Loading journal descriptors... sorting... done The oldest inode block that is still in the journal, appears to be from 1281635206 = Thu Aug 12 13:46:46 2010 Journal transaction 16090037 wraps around, some data blocks might have been lost of this transaction. Number of descriptors in journal: 7101; min / max sequence numbers: 16089433 / 16090473 Writing output to directory RESTORED_FILES/ Finding all blocks that might be directories. D: block containing directory start, d: block containing more directory entries. Each plus represents a directory start that references the same inode as a directory start that we found previously.
Searching group 0: DDDDDDDD+DD+++D+++D++++D+++D++++DD++DDD+DddDDDddDdD+Dddddddddd dddddddddd DDDDDDDD+DD+++D+++D++++D+++D++++DD++DDD+DddDDDddDdD+dddddddd ddddddddddddddddddddddddddddddd
Thanks everyone...
-- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - - - Jason Pyeron PD Inc. http://www.pdinc.us - - Principal Consultant 10 West 24th Street #100 - - +1 (443) 269-1555 x333 Baltimore, Maryland 21218 - - - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This message is copyright PD Inc, subject to license 20080407P00.
-
Don Krause -
Jason Pyeron -
Whit Blauvelt