Next  Contents  Prev

What's required to undelete files – its

not always possible


When an important file is deleted even on a moderately active system it will be over written by the system. So once it is discovered you need to recover a file “umount” the disk ASAP. I if you can’t “umount” the disk at the very least drop into single user mode.

DO EVERY thing you can to prevent further writes to the partition where the deleted files was located.

The group structure of ext2fs can help if your files are in a different group the actively used areas of the disk.

As long as your data is not reused you stand a very good chance of recovery even with the odd data block reused you can piece together the missing bits.

When recovering a file you can recreate to on disk structures or copy the data by following the deleted on disk structures. Both methods are used by LDE.

Most other tools work with the copy concept.

To recover your data you will some tools to help these can range from raw disk editors to tools that understand ext2fs all have strengths and weakness.

Next  Contents  Prev