Recovering a accidental deleted file in Linux under ext3
========================================================

2008-05-09 @Frank4DD

It happens to everyone, deleting a important file by accident, being to quick.
For me, it was a large configuration file for the Smokeping monitoring system,
no backup available.  It happened under Suse 10.3 Linux in the root partition
with a ext3 filesystem.  And I needed to recover it in 30 minutes to bring the
application back online.

I checked the following tools available for file recovery in Linux:

1. recover-1.3c

URL: http://recover.sourceforge.net/linux/recover/

Unfortunately it works only for ext2 filesystems, no chance on ext3, I tried.

2. Midnight Commander

Undelete function likewise works only on ext2 as described. A user reported
success using it on ext3, but didn't work for me, as expected.

3. ext3grep-0.6.0

URL: http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

Most promising, excellent documentation. However, didn't work correctly on a
mounted partition. Checked quickly if it was in Knoppix or another live Linux,
but I found no info. It would have taken to long and I did not dare to shut
down and try.

4. magicrescue-1.1.5

URL: http://jbj.rapanden.dk/magicrescue/

This one did the trick. Yes!!! It comes with recovery recipies for mp3 and
pictures. I copied the one recipe for perl to 'ss' and adjusted it to match
an ascii string I knew would be in the config file. Then I created the recovery
files directory /home/fm/recover and run:

magicrescue -b 1 -d /home/fm/recover -r ss /dev/sda2

I got 227 files recovered, and a quick grep in them showed my config file was
among them!

cd /home/fm/recover; grep smokeping *
...
00000B04F12B-0.:smokeping/images
00000B04F12B-0.:datadir  = /home/smokeping/data
00000B04F12B-0.:smokemail = /home/smokeping/etc/smokemail
00000B04F12B-0.:cgiurl   = http://localhost/smokeping/cgi-bin/smokeping.cgi
00000B04F12B-0.:tmail = /home/smokeping/etc/tmail
00000B04F12B-0.:template = /home/smokeping/etc/basepage.html
000022004E3F-0.:smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `shl_load'
000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `dlopen'
000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/configure:9048: warning: Using 'dlopen'
 in statically linked applications requires at runtime the shared libraries from the glibc
 version used for linking
000024846496-0.:smokeping/echoping-6.0.2/conftest.c:38: undefined reference to `pow'
...

A quick view showed the recovered config file named 00000B04F12B-0. was almost fully
intact, just a few lines missing on the top from the ** General ** section, easy to replace.

After further reading I found this way which I believe would have worked too:
http://recover.sourceforge.net/unix/
Maybe worth to try next time. Not sure how well it works for non-ASCII files.

Phew. Close call. Safe again. :-)