[TriLUG] file recovery utility for ext2?

[Robert P. J. Day]

On Thu, 9 Oct 2003, Dan Monjar wrote:

> --On Thursday, October 09, 2003 07:53:22 AM -0400 "Robert P. J. Day" 
> <rpjday at mindspring.com> wrote:
> 
> > On Thu, 9 Oct 2003, Sinner from the Prairy wrote:
> >
> >> On Thursday 09 October 2003 03:26 am, Robert P. J. Day wrote:
> >> > so you could always transform the filesystem back to ext2 with
> >> > the "tune2fs" command.
> >>
> >> Yes.
> >>
> >> But deleted files would remain undeleted.
> >
> > i wasn't suggesting that simply changing the filesystem back to
> > ext2 would recover deleted files.  i was responding to the point
> > that a number of the file undeletion utilities work only on ext2,
> > not ext3.  so, as a first step, converting back to ext2 would at
> > least allow someone to try those utilities.
> >
> > rday
> >
> 
> but if this conversion was anything more than just flipping a flag 
> somewhere, in other words it actually moved data around, I would imagine 
> the data belonging to the deleted file would get hosed.  for that matter, 
> if the systems has remained active while we've been having this discussion 
> what are the chances that the disk sectors holding the data have already 
> been overwritten?

i'm not going to make any promises, but i *have* converted filesystems
between ext2 and ext3 (going both ways).  AFAIK, the only relevant 
difference is that the ext3 filesystem has a journal file (actually
named .journal if memory serves, but handled by a "hidden" inode,
so that you can't see it).  just like every filesystem has a lost+found
directory, every ext3 filesystem has a .journal file.  and, as i said,
AFAIK, that's really the only difference.

even if a filesystem is ext3, you can always mount it as ext2 if you
don't want to take advantage of the journalling.

and, having said all that, that's why i'm concluding that, if you 
have a utility that works only on ext2 filesystems, there's no harm
in converting ext3 -> ext2 and working with it that way.  and you
can always convert back to ext3 later.  ("man tune2fs").

most importantly, if you just deleted a valuable file, first thing to
do is *unmount* that filesystem pronto!  then worry about how to deal
with it.

rday

p.s.  it *is* a bit odd that these utilities refuse to handle ext3
filesystems, since the difference really shouldn't affect their
operation if the filesystem is unmounted.

and, for that matter, if those utilites work on mounted filesystems,
just unmount the filesystem and remount it as ext2.  i have to wonder
if those utilities will be happy with that.