Re: [Lilux-help] Ext3

Christophe HENRY wrote: [...] Good piece of advice. Before doing anything else on the partition, back up the image to some safe place. Otherwise newly created files might overwrite the space previously taken by the photos. [...] I have a tool (see attachment) that searches for "signatures" in a device or file. (It initially was intended to find partition signatures of a hard disk which lost its partition table, but it may be used for this purpose too...) Usage: searchSignature -o 6 -a JFIF </dev/hda6 -o 6 offset where the file signature occurs -a JFIF ASCII String to search for (you may also search for hex using -b) Sample output: 000010835000 541097 541096 0000108ce000 542321 542320 000011169000 559945 559944 The last column is the sector where the file starts: 541096, 542320, 559944 Retrieve the file as follows: dd if=/dev/hda6 bs=512 skip=541096 count=1000 of=myimg.jpg ... and hope for the best (assuming your image was half a meg. Specify a bigger count if you think your images are larger. Too large doesn't hurt, but if size is too small, you only get the top). The program only finds the first sector. However, nowadays, modern filesystems store files contiguously whenever possible (i.e. when partition was not too full when the file was created). I know reiserfs does this, and ext3 probably as well. If files are not contiguous, you only will see the top of the photo as well. There is also a debugfs tool included with ext2/ext3, which might help. The dump_unused command of debugfs dumps out all unused (i.e. maybe deleted?) blocks to stdout. echo dump_unused | debugfs test.img >dump.bin Then you can strip out the headers ("Unused block 1097 contains non-zero data:") out of that file via an appropriate program, and work on the dump.bin. With that method, you might even be able to rescue non-contiguous photos (if the disk was rather full) Of course, make sure the output file (myimg.jpg) is not on the partition that you are trying to rescue... Alain