ext3grep Google Group

Re: Directory that is now a 0 length file

riley.char...@gmail.com (C) — Mon, 21 Jul 2008 20:33:44 UT

Hi Carlo,

Yes, I committed the sin of asking before reading =). I've since gone
through your excellent howto and spent the weekend reading lots of
information on ext-users, and am just now grasping the hurdle I face.

I think if I'm lucky and the corruption is limited to this directory,
the subdirectories and the data under them are still intact. It's a

Re: So far I am unable to use ext3grep

nowuk...@gmail.com (Gmail User) — Sun, 20 Jul 2008 22:17:40 UT

Actually, the exact command was:
ext3grep $IMAGE --after 1214884800 --dump-names
and ext2grep version is is 0.7.0
TIA,
Ed

So far I am unable to use ext3grep

nowuk...@gmail.com (Gmail User) — Sun, 20 Jul 2008 22:09:42 UT

I tired numerous times and computer would either freeze or exit X
Windows, etc. I was furstrated since I did not see any error messages.
This time I ran it of LiveCD and while ext3grep eventually crashed
again while executing 'ext2grep $IMAGE --dump-names', this time I got
an error message to report:

Re: [ext3grep] Directory that is now a 0 length file

ca...@alinoe.com (Carlo Wood) — Sat, 19 Jul 2008 11:02:44 UT

Have a look at --show-journal-inodes

Directory that is now a 0 length file

riley.char...@gmail.com (C) — Fri, 18 Jul 2008 15:08:24 UT

Hi all,

I have a system where a directory somehow changed to a 0 length file.
It used to have some subdirectories nested within it. Can ext3grep be
used to correct a problem like this? Or should I keep googling? Any
advice will be greatly appreciated.

Charles

Re: [ext3grep] Re: How to recover a file set to zero bytes?

ca...@alinoe.com (Carlo Wood) — Sat, 12 Jul 2008 18:08:47 UT

Well, I have another idea... if blocks 3294056, 3294057, 3294058, 3294059
and so on (as you showed) are indeed block of your file, then this is
in group 3294056 / 32768 = 100. Even if the first 12 blocks are not
known at the moment, you could use the structure of the tripple indirect
block and everything it points to to find all blocks and their groups

Re: [ext3grep] Re: How to recover a file set to zero bytes?

nicola.fankhau...@variant.ch (Nicola Fankhauser) — Sat, 12 Jul 2008 14:29:50 UT

hi carlo
I managed to rescue the small bash-script I was looking for in the big
8GB-ext3-image with the following very crude tools:
--context=500 --fixed-strings 'some-unique-string' > found.txt
after some 2 hours of scanning the whole 120GB, I had the content I
wanted. since this was the ultimate goal, I would like to thank you for

Re: [ext3grep] Re: How to recover a file set to zero bytes?

nicola.fankhau...@variant.ch (Nicola Fankhauser) — Sat, 12 Jul 2008 13:29:45 UT

hi carlo
hehe, the joys of little-endian vs. big-endian. thanks for the hint.
so, my quest could be furthered with your help again (see below).
however I know that the file I am looking for does not begin with what
it printed me out in the last block (ABCDEFGHIJKLMNO etc. - counting
exercise? who does that?) - it may be however the first block having

Re: [ext3grep] Re: How to recover a file set to zero bytes?

ca...@alinoe.com (Carlo Wood) — Sat, 12 Jul 2008 12:59:32 UT

It is 0x00324369 = 3294057 which is NOT out of range.

Re: [ext3grep] Re: How to recover a file set to zero bytes?

nicola.fankhau...@variant.ch (Nicola Fankhauser) — Sat, 12 Jul 2008 08:54:26 UT

hi carlo
thanks a lot for analysing this strange situation.
for the record, I tried to backup the file and managed to overwrite the
original while compressing.
unfortunately, I get the following output when printing out block 3294056:
hamster:~# ext3grep /dev/hda3 --print --block 3294056 | head
Running ext3grep version 0.7.0

Re: [ext3grep] Re: How to recover a file set to zero bytes?

ca...@alinoe.com (Carlo Wood) — Sat, 12 Jul 2008 01:18:46 UT

I don't know what you did to truncate the file,
and if I did, then I don't know what ext3 does
in detail in that case.
However, basically - you want to find out what
was the inode number of the file before you
truncated it. Possibly that is the same
inode number as it current has, possible not.
Then you want to find old copies of that inode

Re: [ext3grep] How to recover a file set to zero bytes?

nicola.fankhau...@variant.ch (Nicola Fankhauser) — Fri, 11 Jul 2008 22:09:50 UT

hi
I gathered some more information about the overwritten file, however I
don't know how to rescue this file (since it's got holes and indirect
blocks, so the method with 'dd' like described in the HOWTO from carlo
does not work here AFAIK).
how do I proceed from here?
thanks!
nicola
------
Running ext3grep version 0.7.0

How to recover a file set to zero bytes?

nicola.fankhau...@variant.ch (Nicola Fankhauser) — Fri, 11 Jul 2008 21:36:03 UT

hello

first of all, I would like to thank carlo for the work put in
ext3grep. unfortunately, I decided to try and backup a big file (8GB
sparse file, 350MB of real data), but instead ended up overwriting it
with 0 bytes. I immediately re-mounted the filesystem (which is ext3)
read-only, so that no data gets overwritten.

Re: [ext3grep] can not complete the procedure

ca...@alinoe.com (Carlo Wood) — Wed, 09 Jul 2008 11:02:20 UT

Interesting...
Can you follow this procedure please:
[link]

can not complete the procedure

t...@am-horizon.com (amsoft2001) — Wed, 09 Jul 2008 05:52:48 UT

at the end of 1st stage its showing me the following error.. any
suggession?

ext3grep.cc:507: void inode_mmap(int): Assertion `refs_to_mmap[group]
== 0' failed.
Backtrace:
addr2line: 'ext3grep': No such file
addr2line: 'ext3grep': No such file
addr2line: 'ext3grep': No such file