Re: file open -> disk full -> save -> file 0 byte

Ralf Gross schrieb:
> Hi,
> 
> a user had a file open when the disk ran full. He then saved the file
> and now it's size is 0 byte (ext3). I don't know much more about this,
> but he asked me if there is any chance to get the data of this file
> back?

ext3grep /dev/sda6 --restore-file  path/to/file

restored only the 0 byte version but I found something with ext3grep. The user
remembered that the string "static void Associate_cluster" is part of the file.


~ # ext3grep /dev/sda6 --search "static void Associate_cluster"
Running ext3grep version 0.10.1
Number of groups: 53
Minimum / maximum journal block: 932 / 34660
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be
from 1286405586 = Thu Oct  7 00:53:06 2010
Number of descriptors in journal: 24920; min / max sequence numbers:
63706 / 72291
Blocks containing "static void Associate_cluster": 325515 (allocated)
904535 915577 1428545


I can get some further output with 'ext3grep /dev/sda6 --block 325515'

~ # ext3grep /dev/sda6 --block 325515
Running ext3grep version 0.10.1
No --ls used; implying --print.

Number of groups: 53
Minimum / maximum journal block: 932 / 34660
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1286405586 = Thu Oct  7 00:53:06 2010
Number of descriptors in journal: 24920; min / max sequence numbers: 63706 / 72291
Hex dump of block 325515:
0000 | 61 6e 65 4f 66 66 73 65 74 3b 0a 20 20 20 20 73 | aneOffset;.    s
0010 | 70 75 72 5f 70 6f 6c 79 5f 6d 65 73 73 2e 63 30 | pur_poly_mess.c0
[....]
0fd0 | 5f 48 6f 73 74 49 66 5f 74 20 2a 68 6f 73 74 49 | _HostIf_t *hostI
0fe0 | 66 2c 20 64 6f 75 62 6c 65 20 2a 56 61 6c 75 65 | f, double *Value
0ff0 | 4c 69 73 74 2c 20 69 6e 74 20 2a 56 61 6c 75 65 | List, int *Value



~ # ext3grep /dev/sda6 --search-inode 325515
Running ext3grep version 0.10.1
Number of groups: 53
Minimum / maximum journal block: 932 / 34660
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1286405586 = Thu Oct  7 00:53:06 2010
Number of descriptors in journal: 24920; min / max sequence numbers: 63706 / 72291
Inodes refering to block 325515: 145601


~ # ext3grep /dev/sda6 --inode 145601
Running ext3grep version 0.10.1
No --ls used; implying --print.

Number of groups: 53
Minimum / maximum journal block: 932 / 34660
Loading journal descriptors... sorting... done
The oldest inode block that is still in the journal, appears to be from 1286405586 = Thu Oct  7 00:53:06 2010
Number of descriptors in journal: 24920; min / max sequence numbers: 63706 / 72291

Hex dump of inode 145601:
0000 | ed 81 e8 03 2b ae 02 00 61 69 9b 4c ee c2 ad 4c | ....+...ai.L...L
0010 | 0e a8 7e 49 00 00 00 00 e8 03 01 00 60 01 00 00 | ..~I........`...
0020 | 00 00 00 00 00 00 00 00 77 f7 04 00 78 f7 04 00 | ........w...x...
0030 | 79 f7 04 00 7a f7 04 00 7b f7 04 00 7c f7 04 00 | y...z...{...|...
0040 | 7d f7 04 00 7e f7 04 00 7f f7 04 00 80 f7 04 00 | }...~...........
0050 | 81 f7 04 00 82 f7 04 00 83 f7 04 00 00 00 00 00 | ................
0060 | 00 00 00 00 f2 97 92 a7 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
Group: 9
Generation Id: 2811402226
uid / gid: 1000 / 1000
mode: rrwxr-xr-x
size: 175659
num of links: 1
sectors: 352 (--> 1 indirect block).

Inode Times:
Accessed:       1285253473 = Thu Sep 23 16:51:13 2010
File Modified:  1286456046 = Thu Oct  7 14:54:06 2010
Inode Modified: 1233037326 = Tue Jan 27 07:22:06 2009
Deletion time:  0

Direct Blocks: 325495 325496 325497 325498 325499 325500 325501 325502 325503 325504 325505 325506
Indirect Block: 325507



So I know that there is something left of the file, but I don't know how to get
it back.


Ralf