Linux Ext2fs Undeletion mini-HOWTO

• Index
• Introduction
• How not to delete files
• What recovery rate can I expect?
• So, how do I undelete a file?
• Unmounting the file system
• Preparing to change inodes directly
• Preparing to write data elsewhere
• Finding the deleted inodes
• Obtaining the details of the inodes
• Recovering data blocks
• Modifying inodes directly
• Will this get easier in future?
• Are there any tools to automate this process?
• Colophon
• Credits and Bibliography
• Legalities

12. Will this get easier in future?

Yes. In fact, I believe it already has. Although as of this writing, current stable kernels (in the 2.0.x series) zero indirect blocks, this does not apply to development kernels in the 2.1.x series, nor to the stable 2.2.x series. As I write this on 2 February 1999, kernel 2.2.1 was released a few days ago; Linux vendors are likely to start producing distributions containing and supporting 2.2.x kernels a month or two from now.

Once the indirect-zeroing limitation has been overcome in the production kernels, a lot of my objections to the technique of modifying inodes by hand will disappear. At the same time, it will also become possible to use the dump command in debugfs on long files, and to conveniently use other undeletion tools.