I just had to google around to find how to undelete some file on reiserfs, no luck so far except I can still grep the text on /dev/hda3. Soo, not that bad! Anyway, I found possibly nice tools for ext2 users: http://recover.sourceforge.net/linux/recover/ http://recover.sourceforge.net/linux/recover/download.php3
I've tried it to recover a freshly (20 seconds ago) removed file, but this utility did not find anything. Is it actually working?
Well, I haven't tried myself as I needed undelete on reiserfs, but have created ext2 on usb flashdisk on sdb. Unfortunately, I get coredumps. I'll contact the author about this problem. I use 2.6.10-rc3-bk16. # recover /dev/sdb Recover v1.3b by Tom Pycke <Tom.Pycke@advalvas.be> Getting inodes (this can take some time)... debugfs 1.35 (28-Feb-2004) Segmentation fault (core dumped) # gdb /usr/bin/recover core GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1". Core was generated by `recover /dev/sdb'. Program terminated with signal 11, Segmentation fault. warning: current_sos: Can't read pathname for load map: Input/output error Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x08048ffb in get_inodes (device=0xbffff29c "/dev/sdb") at recover.c:203 203 cur_inode->next_inode = NULL; (gdb) where #0 0x08048ffb in get_inodes (device=0xbffff29c "/dev/sdb") at recover.c:203 #1 0x08049e88 in start_it (device1=0xbffff29c "/dev/sdb", all=0) at ui.c:239 #2 0x0804978e in main (argc=2, argv=0xbfffd464) at recover.c:412 (gdb) bt full #0 0x08048ffb in get_inodes (device=0xbffff29c "/dev/sdb") at recover.c:203 temp = " 12 0 100644 122951 13/ 13 Mon Jan 3 10:04:38 2005\n\000ĚĎ˙ż
Well, I haven't tried myself as I needed undelete on reiserfs, but have created ext2 on usb flashdisk on sdb. Unfortunately, I get coredumps. I'll contact the author about this problem. I use 2.6.10-rc3-bk16. # recover /dev/sdb Recover v1.3b by Tom Pycke <Tom.Pycke@advalvas.be> Getting inodes (this can take some time)... debugfs 1.35 (28-Feb-2004) Segmentation fault (core dumped) # gdb /usr/bin/recover core GNU gdb 6.0 Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1". Core was generated by `recover /dev/sdb'. Program terminated with signal 11, Segmentation fault. warning: current_sos: Can't read pathname for load map: Input/output error Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 #0 0x08048ffb in get_inodes (device=0xbffff29c "/dev/sdb") at recover.c:203 203 cur_inode->next_inode = NULL; (gdb) where #0 0x08048ffb in get_inodes (device=0xbffff29c "/dev/sdb") at recover.c:203 #1 0x08049e88 in start_it (device1=0xbffff29c "/dev/sdb", all=0) at ui.c:239 #2 0x0804978e in main (argc=2, argv=0xbfffd464) at recover.c:412 (gdb) bt full #0 0x08048ffb in get_inodes (device=0xbffff29c "/dev/sdb") at recover.c:203 temp = " 12 0 100644 122951 13/ 13 Mon Jan 3 10:04:38 2005\n\000ĚĎ˙żý˙˙˙\000\000\000\000 \227ţˇh\222ţˇŁ\234y\006@Đ˙żĐ\b\000¸\n\206\004\b\000 ţˇ\f\207\004\b4\224ěˇh\222ţˇř\001\000¸\002\000\000\000ř\001\000¸\000\000\000\000\004Đ˙żîh˙ˇ\000\000\000\000dŹěˇ", '\0' <repeats 12 times>, "I\035˙ˇ\004\a\000¸\000\000\000Đ\b\000¸PĐ˙żYN˙ˇp\n\000¸@\225ţˇ\001\000\000\000\001", '\0' <repeats 11 times>... dummy = "\003\000\000\000\020\225ţˇ@\225ţˇ" num_del_inodes = -1208053144 x = 0 pid = -1209225916 fd = {0, 0} blocks = 32 cur_inode = (inode *) 0x7 lastinode = (inode *) 0x0 firstinode = (inode *) 0x8048675 list = (FILE *) 0x804c770 #1 0x08049e88 in start_it (device1=0xbffff29c "/dev/sdb", all=0) at ui.c:239 year = -1208186392 maxday = -1209133963 minday = -1208004560 maxmin = -1073753080 minmin = -1207958400 maxhour = 0 minhour = 32 uid = 975778099 ch = 670249 minsize = 1936289384 maxsize = 1667851642 result = 1919243816 inode_numb = 541027941 count = 1685218679 weekd = "\000:\n" month = "en?\n" device = 0x804c050 "¤\225üˇ¤\225üˇ" dir = "HERE\000OL\000\000\000\000\0008Ó˙ż\034Ó˙żiţěˇ\000\000\000\000\000\000\000\000#\000\000\000˛vl\v\220Ó˙żĐ\b\000¸I\206\004\bDěˇÔ#존 ěˇh\222ţˇ\020\225ţˇ@\225ţˇ\004\a\000¸\000\000\000\000p\n\000¸ŕÓ˙żň\035˙ˇUsted desea filtrar de nuevo l" command = 0x804c668 "" text_str = "JŚńˇ\003\000\000\000č\211üˇPŔ\004\blŃ˙żÔ\003ńˇPŔ\004\b\000đéˇ2ůđˇ\001\000\000\000č\211üˇHŇ˙żĐVđˇPŔ\004\b \000\000\000zS?\000¤\201\000\000É`˙ˇM\205\004\b\020\v\000¸\004\a\000¸\000\000\000\000\000\000\000\000xŃ˙żF\032˙ˇsţěˇk\206\004\b\000\000\000\000ű\nŮA0", '\0' <repeats 11 times>, ",˙ěˇDěˇÔ#ěˇh\222ţˇ\003\000\000\000\020\225ţˇP\225ţˇ\004\a\000¸\000\000\000\000p\n\000¸ Ň˙żň\035˙ˇ\003\206\004\b\2256Ę\006|\204\004\bÜŃ˙ż \n\000¸\001\000\000\000P"... buf = 0x804c0d8 "\034\225üˇ\034\225üˇ" c = 0 '\0' firstinode = (inode *) 0x804c050 startinode = (inode_list *) 0x804c148 tmp_inode = (inode_list *) 0xb80001f8 tmp = (FILE *) 0x0 #2 0x0804978e in main (argc=2, argv=0xbfffd464) at recover.c:412 lang = "/DEV/SDB\000Ô˙ż$\215üˇč\211üˇ\224V˙ˇ\221Ľ\004\bč\211" tmp = 0x8048859 "ÉĂ" <Address 0x804885b out of bounds> device = 0xbffff29c "/dev/sdb" x = 8 all = 0 (gdb)
Here's an answer from Tom Pycke, who wrote this recover tool: "Recover uses the debugfs program. Unfortunately, those guys keep changing the format of their output, and I stopped changing recover. It's probably just one line that needs to be changed, but, well, I stopped doing it."
no point in adding a package that's not maintained ...
