Re: [Hampshire] Ext3 and missing files

Top Page

Reply to this message
Author: Graeme Hilton
Date:  
To: Hampshire LUG Discussion List
Subject: Re: [Hampshire] Ext3 and missing files
Hugo Mills wrote:
> On Wed, Aug 01, 2007 at 01:20:23PM +0100, Graeme Hilton wrote:
>> The filesystem is ext3. Running debugfs and using list_deleted_inodes
>> lists 0 deleted inodes.
>>
>> Where can I go from here?
>
>    Check your wastebasket, if your desktop environment has one.


I don't use a Linux desktop environment. I'm a Windows laptop, Linux
server type person. When Ubuntu or Fedora can get me WPA on this
laptop, I'll switch ;).

>    Run find on the whole system to see if you can see where it's gone,
> or some of the documents in it. (If it's been moved accidentally).


locate didn't find anything, and I ran updatedb to check it was up-to-date.

>    Then unmount the filesystem and run fsck on it. See what gets
> recovered and put in lost+found.


Nothing recovered.

>    After that, break out the hex editor and go looking for your data
> on the disk. There's probably not a lot more you can do at that point.


I've figured out what went wrong, and I thought I'd commit it to the
archive in the hope that some poor unfortunate doesn't repeat the same
mistake.

I downloaded a zipped tar file to have a play with a web-application
(Joomla if anyones interested in the details). I put it in my home
directory and used "tar -xvjf <filename>". This unpacked the tar right
into my home directory without first of all creating a new directory to
live in. I.e. I was expecting it to create Joomla-1.5 and fill that
directory with the files and other stuff from the tar file. Instead it
created several new folders and files in the root of my home directory.

These new folders had interesting names like media, administrator,
images and documents. The last one is the most interesting as of course
tar did not have to create a new directory for that one, it just used my
existing documents folder. "What a mess" I thought and issued the fatal
commands: mkdir Joomla, mv documents Joomla/ etc....

Later when I decided Joomla was far too complicated for me I simply did
rm -rdf Joomla. That's when my documents folder vanished.

The moral of the story - look in the tar file before unpacking it.

tar -tf <filename> and it will show you how it will unpack.


--
Graeme Hilton
(backup strategy = one DVD made in March 2005....)