[H-GEN] recovery of deleted files

[Martin Pool]

On Thu, 30 Oct 1997, Robert Brockway wrote:

> >  3) So, you understand inodes, single, double, and triple indirect blocks,
> >     right?
> 
> I have a broad understanding of the concept.  Interresting stuff, but I'm
> not into poking around low level filesystem system stuff really :)

It is interesting stuff.  (YKYBPTLW....)

One thing that makes recovering by hand hard is that ext2fs whacks out the
indirect blocks -- zeros them, that is -- when a file is deleted.  This
is a feature because it makes fsck recovery from enthusiastic people
hitting the BRS easier :-), but a problem because it means there's no way
of knowing where the data beyond the first few blocks of the file is.  

You can guess that the file will be contiguous, but if you don't do
backups then your disks are probably full and fragmented anyhow.

> In short, make backups

Indeed.

--
Martin

----------------------- HUMBUG General List --------------------------------
echo "unsubscribe general" | mail majordomo at humbug.org.au # To Unsubscribe