How to do the Impossible

Posted on Thursday 12 February 2009

Or How to Undelete Files in an ext3 file system

So this article was supposed to originally be about a great new tool I found for those who rip, share or download  MP3 audio files and are frustrated by the large variance in volume levels between them ( and of course are running Linux! )

I came across this great little utility that allows you to singly, or ( my preference ) batch process MP3 files so that they are all normalized either by album or across the spectrum. It’s called normalize-audio and the really neat thing is that it is also available for Windows as well – so if you don’t have a tool already you can certainly give it a try – the cost of course is “free”.

The home page for normalize-audio is here – and if you want to read up on it before kicking the tires then there is a great article ( so why repeat myself ) here – It really is a great package, however, what happened next led me down a new path, which took a while to find….

While the processing of normalize-audio worked really well, it did leave some traces of it’s processing hidden in some of the directories, and I decided to do a quick find and delete command to get rid of them. Unfortunately, I’m a little rusty in some areas and neglected to test my “assumption” on a smaller test set before implementing my “solution”. The result was that I deleted my entire MP3 directory and everything in it.

After saying a few “choice” words I decided to see what solutions, if any, were available. Thankfully, my music resided within it’s own partition ( like it’s own drive all to itself ) so I unmounted it ( made it not available to the computer ) and started looking.

The first thing I realized was that different file systems require different solutions and since I went with the default file system when I fist installed Ubuntu my file system was ext3. Which immediately started off alarm bells when I got my search results.

All I kept getting were other people looking for a similar solution, and several “authoritative” articles saying that “undelete” is impossible within the ext3 file system ( and quite a few more choice words were released at that point! ) Then I found a quote from one of the  developers – Andreas Dilger  ( the guy who should know more about this than anyone else in the world…)

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as “deleted” and leaves the block pointers alone.

Your only hope is to “grep” for parts of your files that have been deleted and hope for the best.

It took a lot of search combinations and it certainly wasn’t found on the first second or third page of my search results, but eventually ( YES!) I found a kindred spirit, Carlo Wood, who had developed something that worked for him and he was willing to share it with the world…

The tool is called ext3grep and it is amazing ( suffice to say it saved my butt and all my MP3’s are back where they should be. )

Carlo has learned a lot about the ext3 file system, and is willing to share it. The tool and the procedure is not for the faint of hear AND you will need substantive disk space to recover large amounts of deleted directories ( as in my case ) because it will not actually undelete the file as much as copy it’s image and put it elsewhere on the disk for you.

If you are looking to know more about how this program works, and learn more than you probably thought you knew about the ext3 file system then I recommend you read Carlo’s article “How recover deleted files on an ext3 file system”

He has even set up a google group for those interested in participating in his discussion and furtherance of ext3grep. It really does do a lot besides helping you undelete your files. I also have to warn you that you need to read and understand at least some of what Carlo has written about this utility before you proceed.

Once you are confident ( or bold ) enough to use the tool, you will find a link for the source code ( yes it needs to be compiled or built within your system ) which can be downloaded, compiled, and installed within your own system.

Final word – it worked for me and saved me months of rebuilding my library ( with a very good chance of missing something ) hopefully it will do the same for you.

Thank you Carlo for doing the impossible and saving me, and many others from their “oopsies”!

End Article

Please Add Your Comment. PLEASE NOTE: Your comments WILL be held until authorized by the webmaster.