linux-ext4 - Re: ext4 undeletion question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 28 Apr 2009 13:26:09 -0400
From:	"Michael B. Trausch" <mbt@...t.trausch.us>
To:	Theodore Tso <tytso@....edu>
Cc:	linux-ext4@...r.kernel.org, mike-mobile@...usch.us
Subject: Re: ext4 undeletion question

On Tue, 28 Apr 2009 12:11:06 -0400
Theodore Tso <tytso@....edu> wrote:
> There is the program "ext3grep" which will look for older versions of
> the directory and inode table blocks in the journal.  This can work,
> but unfortunately I don't think it's been extended to understand about
> the ext4 extent data structure.

Eh.  Thanks for the mention... gave it a shot, but it seems to fail
nearly immediately:

Tuesday, 2009-Apr-28 at 13:21:41 - mbt@...t - Linux v2.6.29.1
Ubuntu Jaunty:[0-9/10014-0]:undel> sudo ext3grep --restore-all /dev/zestvg/home-retain-undelete
Running ext3grep version 0.10.1
WARNING: I don't know what EXT3_FEATURE_COMPAT_EXT_ATTR is.
ext3grep: ext3grep.cc:119: void run_program(): Assertion `be2le(journal_super_block.s_header.h_magic) == 0xc03b3998U' failed.
zsh: abort      sudo ext3grep --restore-all /dev/zestvg/home-retain-undelete

I guess that means it won't work on an ext4 fs.  :-)

I did create a snapshot of it using LVM (durr, I didn't think of that
before) so the FS is preserved as it was... I just don't know how to go
about digging through it to get the directory that I deleted out.
Hopefully I can figure that out before terribly long, as I am stuck
until I do...

	--- Mike

-- 
Don't fix bugs later; fix them now.
                            --- Steve Maguire

Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)