Re: recover deleted files?

David Woodhouse (
Thu, 5 Dec 1996 17:38:25 +0000

On 3 Dec 1996, Matthew S. Crocker wrote:

> Travis Woodbury ( wrote:
> First,
> Second,
> YOu can search through the raw filesystem by accessing the
> /dev/hda... device. You can write a quick & dirty perl script to
> search for a specific pattern and try to copy some of the data back
> off the drive onto another drive. You can also try using the ext2 fs
> CAUTION. You could lose the whole filesystem if you screw up with
> the editor. I have never used it so I can't there. You should be
> able to find a binary form of the editor at your local Linux FTP
> archive.
> -Matt

I had someone format an entire hard drive the other week - not fun!
Luckily, it was a FAT partition, and I threw together possibly the worst
program I've ever written to get everything back.
I strongly suggest you find a spare drive somewhere and take the extra
time to copy the _ENTIRE_ device to an image on the spare drive, and
mount it through the loopback device:
# cp /dev/hda /mnt/spare/working.copy
# mount -oloop /mnt/spare/working.copy /mnt/screwed

That way, each time you complete screw up the file system (and you will),
you can copy it all from the original drive and start again.

If the ext2fs tools won't work with a disc image, you could copy the
filesystem to the spare drive and then edit it in place, recopying it from
the backup each time, I suppose.

> :
> :
> : Hello,
> :
> : Does anyone know how I would go about recovering some deleted files??
> : Everything I have been told seems to indicate that it _should_ be
> : possible (with lots of work) but nothing says how exactly to go about
> : doing this. I have left the partition mounted read only since soon after
> : having screwed up. (a MB or two did get copied to the partition before I
> : realized what had happened). Partial recovery is much better then
> : nothing at all.
> :
> : I do realize that if this is possible that it isnt going to be easy but I
> : really need those files.
> :
> : Any and or all suggestions/comments would be appreciated.
> : Please send the replies directly to me as I am not on this mailing list.
> :
> : Thanks,
> :
> : -Travis Woodbury <>
> --
> -Matthew S Crocker "The mask, given time, comes
> Crocker Communications to be the face itself." -anonymous
> Internet Division Phone (413) 585-5164
> PO BOX 710 Fax (413) 587-3352
> Greenfield, MA 01302-0710 Email
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

---- ------------------------------------------------ ----
David Woodhouse, WWW:
Robinson College, Email:
Cambridge, Tel: +44 (0) 976 658355
CB3 9AN, (n)talk:
England. PGP KEY: finger
---- ------------------------------------------------ ----