How to rollback an ext3 journal to any point?

Help
2002-04-21
2012-11-28
  • Ok, here goes my (sad) story.

    I was installing a new hard disk in my box. I moved most data from the old one to the new one. I built a tar file with the contents of my /home and I put it on /var/tmp. I zeroed out the old disk and then a spike made my box reset itself (No, I just leaved the room for a moment when it happened. Yes, I have a UPS with surge protection, but everyone knows Murphy's laws) :-(

    On reboot, /var/tmp got cleared and now I'm missing 2.5 Gb of valuable data. Then I booted my box using a rescue disk, and I haven't mount /var since then.

    My /var lives in a ext3 partition with internal journal. I've run debugfs and lsdel said 0 recoverable inodes. logdump command says "Journal starts at block 0. Transaction 1321", but I haven't figured out how to see the contents of the journal nor roll back it.

    Is there any way to roll back the clearing of /var/tmp and recover my data?

    I run Debian GNU/Linux 3.0 (Woody) and ext2fstools 1.27

    Thanks in advance

     
    • try tunefs -O ^has_journal

      if it says "needs_recovery" then

      echo 'feature -needs_recovery' | debugfs -w

       
    • Theodore Ts'o
      Theodore Ts'o
      2008-02-02

      I'm sorry, but the ext3 journal is not a database-style journal which allows rollback to arbitrary points in time.  It's designed to be able to recover from unclean shutdowns.