If your web browser formats this page incorrectly, try viewing the
page source. In netscape 4, click the view menu, then click page source.
Linux overwrites undeleted files quickly, so you want to undelete files as
soon as possible.
Make the partition read only. This prevents linux
from overwriting any more files.
Change to a directory on a partition other
than the partition which you want to undelete files from. Dos
partitions are ok. If all else fails, use a floppy.
Run this command: debugfs -R lsdel /dev/hda1 > l
/dev/hda1 is the partition which you are undeleting files from. l is the
file which you are writing the list of undeletable files to.
Use a text editor to edit file l. Each line is one undeletable file. There
are no filenames. Guess which files you want to undelete based on owner,
size, and delete time. Delete lines which are files which you do NOT want
to undelete. Change the file so the file is like this:
dump <45234> u0
dump <8874314> u1
dump <885432> u2
The number is the inode number for each file you want to undelete. u0, u1,
u2, etc is the name to give to the undeleted file.
Run this command: debugfs -f l /dev/hda1
l is the name of the file with the dump commands. /dev/hda1
is the partition to undelete from.
Examine each undeleted file with less, and rename or delete as appropriate.
For more information, see the Ext2fs-Undeletion howto, and
search the internet for undelete utilities.
Undeleting files is more difficult with 2.0 kernel than with 2.2 kernel,
because 2.0 kernel destroys more data about which blocks were allocated to
the file. Undeleting files with ext3 filesystem is more difficult than
with ext2 filesystem, because ext3 filesystem destroys more
data about which blocks were allocated to the file, and because ext3
destroys more data about owner, group, and permissions.
