[CentOS] Ext3 undelete

> -----Original Message-----
> From: centos-bounces at centos.org 
> [mailto:centos-bounces at centos.org] On Behalf Of Jason Pyeron
> Sent: Thursday, August 12, 2010 17:41
> To: 'CentOS mailing list'
> Subject: Re: [CentOS] Ext3 undelete
> 
> > -----Original Message-----
> > From: centos-bounces at centos.org
> > [mailto:centos-bounces at centos.org] On Behalf Of Whit Blauvelt
> > Sent: Thursday, August 12, 2010 17:31
> > To: CentOS mailing list
> > Subject: Re: [CentOS] Ext3 undelete
> > 
> > On Thu, Aug 12, 2010 at 02:26:00PM -0700, Don Krause wrote:
> > 
> > > http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html
> > 
> > That's an excellent little program. It can take some 
> mucking about to 
> > find the invocation that will save a particular file or set 
> of files, 
> > but it often can get the job done. It's well supported on 
> its mailing 
> > list too.
> > 
> 
> Now the question is will it complete before more than the 
> 100M snapshot is used up...

Searching group 1768: ext3grep: get_block.cc:37: unsigned char* get_block(int,
unsigned char*): Assertion `device.good()' failed.

Disk filled up... Good by files...

> 
> 
> [root at host67 tmp]# ext3grep $IMAGE --restore-all --after=1281653802
> --before=1281656202
> Running ext3grep version 0.10.2
> Only show/process deleted entries if they are deleted on or 
> after Thu Aug 12
> 18:56:42 2010 and before Thu Aug 12 19:36:42 2010.
> 
> WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
> WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set. This either 
> means that your partition is still mounted, and/or the file 
> system is in an unclean state.
> Number of groups: 1846
> Minimum / maximum journal block: 1545 / 9747 Loading journal 
> descriptors... sorting... done The oldest inode block that is 
> still in the journal, appears to be from
> 1281635206 = Thu Aug 12 13:46:46 2010
> Journal transaction 16090037 wraps around, some data blocks 
> might have been lost of this transaction.
> Number of descriptors in journal: 7101; min / max sequence 
> numbers: 16089433 /
> 16090473
> Writing output to directory RESTORED_FILES/ Finding all 
> blocks that might be directories.
> D: block containing directory start, d: block containing more 
> directory entries.
> Each plus represents a directory start that references the 
> same inode as a directory start that we found previously.
> 
> Searching group 0:
> DDDDDDDD+DD+++D+++D++++D+++D++++DD++DDD+DddDDDddDdD+Dddddddddd
> dddddddddd
> DDDDDDDD+DD+++D+++D++++D+++D++++DD++DDD+DddDDDddDdD+dddddddd
> ddddddddddddddddddddddddddddddd
> 
> 
> Thanks everyone...

--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-                                                               -
- Jason Pyeron                      PD Inc. http://www.pdinc.us -
- Principal Consultant              10 West 24th Street #100    -
- +1 (443) 269-1555 x333            Baltimore, Maryland 21218   -
-                                                               -
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
This message is copyright PD Inc, subject to license 20080407P00.