undelete a folder ?

Sylviane et Perry White spwhite at freesurf.ch
Tue Mar 4 18:22:21 UTC 2008


On Monday 03 March 2008 18:57, Billie Walsh wrote:
> I don't know about Linux in general or Kubuntu in particular but
> 
> IF you haven't written anything else to the disk
> If you can open the disk and see the file system
You only see intact files, including  backup (with a trailing ~ in linux) and
hidden (with a leading . in Linux) if your setting is for that.
> When you "delete" a file it will often just remove
Yes
> [ change the referrence ] the file name
Then logically it should not just change but also mark a freed.
> in the allocation table [ I think it's called ]. 
Yes

AFAIK unless you "shred" a file, it is not immediately destroyed, only the 
space it occupied on the drive is marked as free, you're right on that point.
How this is done may be more closely dependant on the file system than on the 
operating system. (?)
I belive there is often some redundancy between the  allocation table and meta 
data stored in the tracks and sectors so it may be possible, starting from a 
sector that contained part of your your file or a pointer to it, to follow 
the links down (and up ?) to reconstruct that file.
(I have used a track-editor to salvage files on a disquette but it was 
incommensurably smaller than a present HD, and I used context rather of 
meta-data because there were text files)
>
> Sometimes I have been able to find this listing and redo the name.
I whish you could be more explicit here.

Best adwise I can provide if you really want to recover important deleted 
files would be, as soon as you notice the problem, to boot from another 
partition or CD and mount the partition with your data read only  because the 
system itself writes ans updates countless files all the time and they all 
can definitively eradicate parts of your data.

Perry

-- 
BOFH excuse #380: Operators killed when huge stack of backup tapes fell over




More information about the kubuntu-users mailing list