debugfs, but it's not all that cut and dry to use (of course, I know the
commands to edit and relink inodes.. but I've been using it for a long
time).
using debugfs to mark inodes with 0 dtimes and 1 link count (undelete)
quite often will bug the kernel out and can cause a panic/crash (as I
noticed the other day, depending on what you touch). You should always run
/sbin/fsck.ext2 afterwards on the effected partition.
note: only about the first 12K plus or minus is guaranteed to be
recovered. After that, you get into single, double, and triple indirect
blocks. The filesystem may not keep information on rm'd files over a
certain size (as I have noticed).
If you still wish to try this program out, you can:
1) make sure its package is installed
2) read the manual page (man debugfs)
3) email me personally to help you use it (it's a trip) :P
One last thing, you seemed to have made a boo-boo in your list
submission.. read your original message.. you wrote what you wanted to
say.. and then under it, said the same thing. cut/paste troubles? :)
On Tue, 21 Nov 2000, Rubén Alonso wrote:
> Hi to all and thanks for your answers.
> I have a new question.
> Is there any way to undelete a file deleted with rm?
> I heard that in ext2 files it could be?
> Is it possible under Unix?
> where is stored the ftp sessions?
>
> Thanks.
>
> Hi to all and thanks for your answers.
> I have a new question.
> Is there any way to undelete a file deleted with rm?
> I heard that in ext2 files it could be?
> Is it possible under Unix?
> where is stored the ftp sessions?
>
> Thanks.
-Statux
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
