Next
Previous
Contents
The procedure principally involves finding the data on the raw partition
device and making it visible again to the operating system. There are
basically two ways of doing this: one is to modify the existing file system such
that the deleted inodes have their `deleted' flag removed, and hope that the
data just magically falls back into place. The other method, which is safer
but slower, is to work out where the data lies in the partition and write it
out into a new file on another file system.
There are some steps you need to take before beginning to
attempt your data recovery; see sections
Unmounting the file system,
Preparing to change inodes directly and
Preparing to write data elsewhere for details.
To find out how to actually retrieve your files, see sections
Finding the deleted inodes,
Obtaining the details of the inodes,
Recovering data blocks and
Modifying inodes directly.
Next
Previous
Contents
|
Take our 
