linux-ext4 - Re: ext4 undeletion question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090428161106.GB24043@mit.edu>
Date:	Tue, 28 Apr 2009 12:11:06 -0400
From:	Theodore Tso <tytso@....edu>
To:	"Michael B. Trausch" <mbt@...t.trausch.us>
Cc:	linux-ext4@...r.kernel.org, mike-mobile@...usch.us
Subject: Re: ext4 undeletion question

On Tue, Apr 28, 2009 at 10:42:39AM -0400, Michael B. Trausch wrote:
> (First things first, please keep my cell phone -- mike-mobile@...usch.us  
> -- on the cc list, as I cannot easily read mail on my system since it is, 
> more or less, crippled at the moment.)
>
> Alright, so I have found myself in a troublesome situation.  I had a  
> directory which I accidentally deleted (instead of an identically-named  
> directory in *another* directory) and I need to get it back; it was a  
> version control repository directory and contains ~150 revisions of a  
> project I have been working on this week.  (Ironically, I was preparing 
> to back it up today, heh.)
>
> Anyway, is there _any_ means by which to recover files from an ext4  
> filesystem?  The utils for ext2 filesystems don't work (not surprising),  
> and I am wondering if there is a way to look for deleted files, knowing  
> what their name was, and recover them if they are not yet overwritten.  I 
> have my home directory mounted read-only at this point so as to minimize  
> the chance of the latter, and discovered my mistake nearly immediately so 
> I hope that the data are still intact.

There is the program "ext3grep" which will look for older versions of
the directory and inode table blocks in the journal.  This can work,
but unfortunately I don't think it's been extended to understand about
the ext4 extent data structure.

						- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html