How to restore deleted files from ext3
Fast Information:
PARTITION=/dev/sda3 # the partition where you have deleted something
SAVE=/mnt/sda6/save # the place where you can backup your _whole_ partition
dd if=$PARTITION bs=4096 of=$SAVE
ext3grep $SAVE --restore-file home/balrok/veryImportant # the file you are searching can be set here
Disclaimer
Cause this is a sensible subject: If you will lose any data or break your whole system with that guide.. It's all your own's fault cause you have to think before following just some guy somewhere over the internet ;)But for me it did work.. so with some luck you'll get as happy as me too
My Story about that
It happened to me right now - i wanted to delete some files in my home tipped: rm bla<tab>* and then the mistake happened.. bla existed just once (instead of twice as i thought) and it expanded to "rm blabla *"I had luck, that I haven't used the -r switch but still a valuable file was missing.
My home-directory is inside root - my root-partition is luckily not very big (the first time I'm happy about that)
So I just did:
(sda3 is my root partition and sda6 my bigdata storage)
dd if=/dev/sda3 bs=4096 of=/mnt/sda6/save
This is the first and most important step - best would perhaps be to instantly unmount the partition but with root-partitions this is a bit problematic..
My next unsuccessfull step was grepping through that 10gb file (took hours and at the end I had nothing useful)
But there exists also a tool made for restoring shortly deleted files from ext3.
Ext3 is so special cause it nulls out the block where the file was.. this tool can circumvent this (i guess by using the journaling-data)
The only problem I had was, that I just was to thrilled for reading the whole page on how to do it.. But when the Thrilling cooled down after several hours of grep-waiting I discovered the easy switch:
ext3grep /mnt/sda6/save --restore-file home/balrok/veryImportant