Thread: [Extundelete-users] extundelete: No undeleted copies found in the journal. ??¿¿ depends exclusivelly
Status: Beta
Brought to you by:
necase
From: <ext...@li...> - 2015-05-25 17:21:15
|
after several tries and tests, i concluyed that this tool depend extensivelly of the journally.. so then i ask: 1) if a file are deleted long time ago.. will be recovered? 2) i delete a file, then 2,3sec unmounted and try to recover, got "No undeleted copies found in the journal." why in etx3? 3) if i complied again a extfslib 1.40, it will work if i run in another host with extfslib 1.42 using etx4 partitions? Lenz McKAY Gerardo (PICCORO) http://qgqlochekone.blogspot.com |
From: <ext...@li...> - 2015-05-25 17:42:46
|
On 25/05/2015 19:21, ext...@li... wrote: > 1) if a file are deleted long time ago.. will be recovered? > 2) i delete a file, then 2,3sec unmounted and try to recover, got "No > undeleted copies found in the journal." why in etx3? if you need to recover files without the file system structures, you can use PhotoRec: https://en.wikipedia.org/wiki/PhotoRec Valerio |
From: <ext...@li...> - 2015-05-26 02:06:07
|
Hi Lenz, On 5/25/15 12:21 PM, ext...@li... wrote: > after several tries and tests, i concluyed that this tool depend > extensivelly of the journally.. Yes, extundelete must use the journal to find deleted files. > > so then i ask: > > 1) if a file are deleted long time ago.. will be recovered? Maybe. The journal may still have a copy of the necessary information if it has not been overwritten yet. Of course, more recent deletions are more likely to be recoverable (the sectors on the drive be overwritten at any time as well). > 2) i delete a file, then 2,3sec unmounted and try to recover, got "No > undeleted copies found in the journal." why in etx3? I have seen this, when testing, but didn't try to find the cause. It may be the file was never flushed to disk, or never recorded in the journal, or the journal should be replayed (as it would be when mounting it) to finish completing the deletion event (in that case, debugfs from e2fsprogs should be able to recover the file as if it were never deleted). > 3) if i complied again a extfslib 1.40, it will work if i run in another > host with extfslib 1.42 using etx4 partitions? Running with a different version of e2fsprogs than it was compiled with is a bad idea. You should recompile with the same version of e2fsprogs that you run with. Nic |