by I am trying to recover files of varying length under linux 1.3.32. I am
using lde version 2.8. The filesystem in question was frozen after the
error which led to the lost files was discovered (very soon). The
filesystem is an ext2 system.
Lde reports that none of the blocks used by the old file are in use by
other files. Hence, it should be pretty easy to restore them
(theoretically).
However, lde will only restore 12K of the lost files. I have been
searching the raw disk blocks, and patching together contiguous blocks,
but this is VERY time consuming. There must be a better way.
As I understand the ext2 (for that matter, most unix) filesystem, the
inode is composed of direct and various levels of indirect blocks. The
indirect blocks SHOULD point to the next direct block within the file in
the first 4 bytes of the file. This does not appear to be the case.
Decoding the first four bytes points to an unrelated file (yes, I do it
in "reverse")... Double indirect blocks point to two single indirect
blocks, etc. The 12K that lde restores appear to be ONLY the direct blocks.
I am very confused why the program does not simply write out the data
pointed to by the original inode. The documentation for this program
seems to point in this direction... Even if this is not possible, would
it be possible to copy the raw inode itself and place it on the disk in
question. This should give a file handle by which data could be
retrieved. This also does not work. Simply relinking the inode doesn't
work either.
Am I missing something very obvious? Has anyone used this program before
(or any other disk recovery program under linux for that matter)?
Thanks for any help you can give,
Mike Coogan