linux-ext4 - Re: ext4 undeletion question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20090428152908.1e98e991@zest.trausch.us>
Date:	Tue, 28 Apr 2009 15:29:08 -0400
From:	"Michael B. Trausch" <mbt@...t.trausch.us>
To:	Andreas Dilger <adilger@....com>
Cc:	Greg Freemyer <greg.freemyer@...il.com>,
	Theodore Tso <tytso@....edu>, linux-ext4@...r.kernel.org,
	mike-mobile@...usch.us
Subject: Re: ext4 undeletion question

(Andreas, sorry for the dup, forgot to hit reply-all the last time.  My
fault.)

On Tue, 28 Apr 2009 12:53:46 -0600
Andreas Dilger <adilger@....com> wrote:

> The good news is that ext4 usually allocates file blocks contiguously
> so if you can find the inodes themselves in the journal you can likely
> extract most of the data just by printing the in-inode extents to find
> the block ranges and then dumping the file data with 'dd'.

So, here's what my current situation is:

  * I deleted a .bzr directory which contains files and additional
    directories.  AFAIK, directories are just "files", but exposed
    differently to the operating system, yes?  So I should be able to,
    if I were to find its inode, find all of its descendants, too, to
    bring them back, right?  I don't have a directory listing from
    before the deletion, and I presume that would make all the
    difference in the world.  Also, I'd need to figure out which one
    would be the correct one; I've deleted other .bzr directories (as
    part of their directory trees) repeatedly in the past on this
    filesystem.

  * This filesystem was in fact created as ext4.  I'd attempted an
    upgrade some time ago, but the upgrade took *ages* and so I aborted
    it early, reformatted, and restored my home directory from a
    tarball on the new filesystem.

  * I know where in the directory tree the .bzr directory had a link,
    obviously.  I don't know if that information is helpful or not,
    though, unless having the inode # of the containing directory is
    useful in some way.

  * I don't know _anything_ about how journaling works, but I do know
    that the directory was about a week old (just young enough to not
    be on a backup; since some hardware changes were made I hadn't
    started my hourly rsnapshot back up since I don't currently have a
    drive to rsnapshot to---d'oh!)

I'd be happy to look into options, though as I mentioned in my previous
message, I am not a solid system-level programmer (at least in my own
personal opinion).  I could probably figure it out, given enough time,
but when it comes to C (or C++) I just plain _suck_.  I am trying to
improve that, though.

	--- Mike

-- 
I don't really know that anybody's proven that a random collection of
people doing their own thing actually creates value.
                            --- Steve Ballmer, 2007

Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)