Ok, here goes my (sad) story.
I was installing a new hard disk in my box. I moved most data from the old one to the new one. I built a tar file with the contents of my /home and I put it on /var/tmp. I zeroed out the old disk and then a spike made my box reset itself (No, I just leaved the room for a moment when it happened. Yes, I have a UPS with surge protection, but everyone knows Murphy's laws) :-(
On reboot, /var/tmp got cleared and now I'm missing 2.5 Gb of valuable data. Then I booted my box using a rescue disk, and I haven't mount /var since then.
My /var lives in a ext3 partition with internal journal. I've run debugfs and lsdel said 0 recoverable inodes. logdump command says "Journal starts at block 0. Transaction 1321", but I haven't figured out how to see the contents of the journal nor roll back it.
Is there any way to roll back the clearing of /var/tmp and recover my data?
I run Debian GNU/Linux 3.0 (Woody) and ext2fstools 1.27
Thanks in advance
try tunefs -O ^has_journal
if it says "needs_recovery" then
echo 'feature -needs_recovery' | debugfs -w
I'm sorry, but the ext3 journal is not a database-style journal which allows rollback to arbitrary points in time. It's designed to be able to recover from unclean shutdowns.