undelete a folder ?
Sylviane et Perry White
spwhite at freesurf.ch
Tue Mar 4 18:22:21 UTC 2008
On Monday 03 March 2008 18:57, Billie Walsh wrote:
> I don't know about Linux in general or Kubuntu in particular but
>
> IF you haven't written anything else to the disk
> If you can open the disk and see the file system
You only see intact files, including backup (with a trailing ~ in linux) and
hidden (with a leading . in Linux) if your setting is for that.
> When you "delete" a file it will often just remove
Yes
> [ change the referrence ] the file name
Then logically it should not just change but also mark a freed.
> in the allocation table [ I think it's called ].
Yes
AFAIK unless you "shred" a file, it is not immediately destroyed, only the
space it occupied on the drive is marked as free, you're right on that point.
How this is done may be more closely dependant on the file system than on the
operating system. (?)
I belive there is often some redundancy between the allocation table and meta
data stored in the tracks and sectors so it may be possible, starting from a
sector that contained part of your your file or a pointer to it, to follow
the links down (and up ?) to reconstruct that file.
(I have used a track-editor to salvage files on a disquette but it was
incommensurably smaller than a present HD, and I used context rather of
meta-data because there were text files)
>
> Sometimes I have been able to find this listing and redo the name.
I whish you could be more explicit here.
Best adwise I can provide if you really want to recover important deleted
files would be, as soon as you notice the problem, to boot from another
partition or CD and mount the partition with your data read only because the
system itself writes ans updates countless files all the time and they all
can definitively eradicate parts of your data.
Perry
--
BOFH excuse #380: Operators killed when huge stack of backup tapes fell over
More information about the kubuntu-users
mailing list