Kewl fun... Undeleting files in ext2

ME dugan at passwall.com
Mon Sep 2 10:13:40 PDT 2002


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is new to me. I remember trying to hand piece together bits of files
many ages ago and the pain it was.

Create a file on some simple filesystem. (For me "/tmp" is on its own
 partition "/dev/hda7")
Put some content into the file that you can remember.
Run "sync"
"rm" the file
Run sync
use mc with appropriate args and the partition with files to undelete:
# mc cd /#undel:hda7
"Tab" to the left pane, and choose (F9) to enable pull down menus.
Under "Left" menu pull down, choose "sort order..."
Highlight "Modify Time" press "space", "tab" over to 
 "Reverse" press "space" tab over to "OK" press "Return"

Now, at the top of the left window pane should be the last files on /tmp
to be deleted. You won't see the original name, but you may see the size
of the file and modification time. With these two pieces of data, you may
or should be able to locate the file that was just deleted.

Now you can highlight the file to undelete, and coose (F5) to copy the
file.

Specify a destination on another filesystem on another partition and
choose "ok".

press (F10) to quit and go examine your destination file.

Kewl, no?

- -ME

- -----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS/CM$/IT$/LS$/S/O$ !d--(++) !s !a+++(-----) C++$(++++) U++++$(+$) P+$>+++ 
L+++$(++) E W+++$(+) N+ o K w+$>++>+++ O-@ M+$ V-$>- !PS !PE Y+ PGP++
t at -(++) 5+@ X@ R- tv- b++ DI+++ D+ G--@ e+>++>++++ h(++)>+ r*>? z?
- ------END GEEK CODE BLOCK------
decode: http://www.ebb.org/ungeek/ about: http://www.geekcode.com/geek.html

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9c5xPnX6uIwdKgeYRAgcpAJ9IEY17H0jQAuWZ0PTjdba/1QiL4QCfSiZW
4MWN8jtivDli0WzkAqsqTC8=
=nLNh
-----END PGP SIGNATURE-----



More information about the talk mailing list