Another Drive Image Recovery…
Friday, February 24th, 2006
…
…this time from rm on an ext3 file system. I thought I was removing a
symbolic link. When rm didn’t return after 5 seconds I looked and
realized I had deleted a 60G NTFS image file containing important data. I
pulled the plug on the server. When I brought the system back up I failed
to stop the mount so some cleanup took place. I wrote down the orphaned
inode number. It turned out to belong to the file I wanted to recover.
I bought a 200G USB disk and copied the whole 160G partition with the ext3
file system which contained the 60G NTFS image file. The operation took
50 hours over a USB 1.1 link.
With debugfs I was able to determine that the direct, indirect and double
indirect blocks had been zeroed. The triple indirect block points to 13
double indirect blocks.