Recover truncated file on ext3

[Emmeran]

Hi guys,

does anyone know how I can recover the contents of a file that has been truncated by gedit. I was editing a file on one of my web servers and somehow the connection was lost and gedit truncated the file. I didn't notice it and closed gedit. So now I have a file with 0 bytes...

Thx,
Emmeran

[NeddySeagoon]

Emmeran,

This is deliberately difficult. First, its important to make the partition read only as soon as possible to avoid the free space that contains your data from being reused. You need to search the free space with a hex editor for a known fragment of your file.

emerge hexedit

make the partition you want to read world readable with chmod /dev/sd... 664 This is a security hole, so reset 660 later but its better than running hexedit as root.

open the partition in hexedit hexedit /dev/sd... then search for someting you know was in the file. The longer the string the better, as the its less likely to occur in other files.

Look at every instance you find, mark the beginning and end of interesting finds, then save them to files.
Rinse and repeat until you can't find any more.

Looks that the files you have saved - pick the best one.

You will need to read man hexedit. Don't run it as root, there is no undo.
Don't forget to fix the permissions on your partition when you are done.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.