Howto restore deleted files from ext3 ?

It happens to everyone sooner or later: a split second after you hit Enter you realize your mistake, but it's too late; you just deleted a valuable file or directory for which no backup exists. Or maybe you have a backup, but it's a month old... and in shock you see the past month flash before your eyes as you realize in pain what you'll have to do all over again...

Fortunately, you remember that files are never really deleted, at most overwritten by new content. So, you remount the disk read-only as fast as possible. But now? On February 7th, 2008, Carlo Wood accidentaly deleted his whole home directory: over 3 GB of data, deleted with rm -rf. The only backup he had was from June 2007. Not being able to undelete was unacceptable. So, he ignored what everyone tried to tell him and started to learn how an ext3 file system really works, and what exactly happens when files are deleted... This is not for the faint of heart, though...

Taking backups may not allways be enough : sometimes, you better take a snapshot image of your boot partition (including /usr and /var), and your MBR. dd might be your friend, but be carefull about the block size. Freshmeat has an interesting article how to use partimage to create clones of partitions.

Ghosty Fri, 03/14/2008 - 09:37

There is a small error in the first link, the "u" from undelete is missing, the correct link is: http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

Anyone have an idea how you can undelete files from XFS? (I use XFS at my fileserver at home and once had the slip of the finger, not that it was really THAT important ...), was just wondering if there exists similar information about XFS undelete, cause a search through google delivered almost nothing.

kristof Fri, 03/14/2008 - 21:29

In reply to by Ghosty

Thanx, that was really weird. (Allways use copy-paste to import links). Must have been full moon or so...