[Thinkpad] Re: Linux file-recovery problem

     I'd like to thank everyone who took the time to reply to my recent question
about Linux file recovery. I still haven't directly attempted the recovery yet,
since I want to make as sure as possible that I understand the situation
properly before acting; being sure of what I'm doing is more important than
being quick in getting onto it. (I am posting from another computer, so not
overwriting the disk further.)

     Robert Turnbull's suggestion to use Knoppix appears not to be necessary,
because my brother, who installed the system in the first place, tells me that
using the original Fedora C.D. in safe mode will accomplish the same thing that
Knoppix would have done - that is, boot up without writing anything to the hard
disk.
     But thanks for the idea all the same.

     Chris Bayley's suggestion about using "The Coroner's Toolkit" may not be
necessary to follow up, but thanks for the idea. My first line of attack is
going to be to grep the entire disk for phrases I know to exist in the files,
but unlikely to occur elsewhere; if I find those, I will either save the output
of "grep" to a file, or, if that is impossible in safe mode, I will just type it
from the screen into another computer. (The files are plain text only, so I can
do this, at the cost of a couple of hours' time.) If for any reason that
doesn't get results, I will consider whether to turn to things like "The
Coroner's Toolkit".
     (Chris, my disk *isn't* nice and full - it's a new computer, so it's mostly
empty. But it seems to me that that should work in my favour. Because I turned
off the computer within a minute or two of discovering my mistake, only minimal
writing to the disk should have occurred - so, with so much empty space
available, that should (hopefully) minimize the chances that the small amount of
writing that might have taken place could have overwritten the data.)

     Kris Steenhaut: you said "if immediately really is immediately". Well, it
was a minute or two later: before pulling the power, I did a few "cd" and "ls"
commands to verify what had happened, but I believe none of these would have
caused any disk writing - in such a situation, I am acutely aware of the need to
prevent any further disk writing whatsoever. But it is possible background
processes were writing to the disk during that minute or two. I'm hoping the
fact that the computer is new and the disk still mostly empty will work in my
favour - although that would largely depend on whether Ext3 file-systems tend to
scatter successive writes around the available empty space, or always go for the
lowest-numbered cluster available in the unused space. This is something I
haven't yet found out, but I think my fortunes will depend largely on how this
works. If successive disk-writes are scattered around, I might have dozens of
cpoies of my files, because I saved them many times before the mistake happened.
     (I remember occasions when I recovered files in MS-DOS or Windows with
Norton Utilities, and I found literally *dozens* of copies scattered around,
some old and out-of-date, and some quite up-to-date. But I also remember that
in very early DOS versions, such as ver. 2, disk writes were always done to the
lowest-numbered available cluster, and, in that arrangemenmt, I usually had only
one or two copies to recover, if even that. Not that I am so careless as to
regularly delete files wrongly - but, in the early days, I sometimes did it
deliberately with spare copies of files, explicitly to see how successfully I
could recover them. This sort of experimentation (done with extreme caution) is
the main way I learned how to use Norton Utilities, alter F.A.T.s, and so on.)
     As for my present Linux/Ext3 system, the only clue I have is that I've been
told Ext3 disk writes are chosen in such a way as to minimize disk
fragmentation. But I don't know whether that will work in my favour or not.
     Kris, you thought that if immediately really was immediately (for cutting
the power), then the mistaken commands' disk writes weren't yet performed, and
the situation an hour or so previously should stand on the disk, meaning the
files weren't deleted at all. While I have yet to examine this, my brother
assures me that this can't be so - the disk writes actually take place within 5
seconds or so at most of the commands being issued, and I definitely took a
minute or two to cut the power. So that won't help, unfortunately. Grepping
for the data appears to be my only hope.

     Anyway, I expect I will do the grepping within the next day or so, when
I've gathered the information I have so far and reviewed it. So I guess I'll
find out the results then.

     As for my other question about getting a new ThinkPad while I can, even
though I've just started a new computer of another brand - I don't know. Thanks
for the various comments there, too.
     Maybe it's a bit silly to get yet another just because I like the idea of
continuing with ThinkPads (although I *do* have enough money to do that if I
really want to). But I am rather dismayed for some reason that I.B.M. is
disposing of ThinkPads, and somehow feel ThinkPads just won't be ThinkPads any
more in anything but name once I.B.M. don't have them any more.
     This could be quite an irrational and emotional reaction, since I know
nothing about Lenovo, and have no idea whether they might maintain the quality,
service, and so on. (I'd never even heard of Lenovo until just a few days ago.)
Perhaps it just partly a fear of the foreign and the unknown.
     I'll certainly keep my eye on the situation, anyway - and maybe get a new
ThinkPad (maybe the last I'll ever have), because, if the brand or its quality
is threatened, I feel I want to have at least one more go, while I can. I
haven't been very happy with my 770ED, for various reasons, and it should have
(and did for a certain period) put me off ThinkPads altogether; but I'm hoping
there are better models now to choose from.
     It appears that ThinkPads are high-quality laptops, and I guess I like the
look and feel and appearance of them, too. So maybe I'm not being entirely
rational about it.
     Is the I.B.M. web site a good source of information on the differences
between the various models? Such information, if not presented clearly, does
tend to make my eyes and mind glaze over as I try to keep track of detailed
information about various models.

                         Regards,
                          Michael Edwards.

_______________________________________________
Thinkpad mailing list
Thinkpad@stderr.org
http://stderr.org/cgi-bin/mailman/listinfo/thinkpad
Received on Sat Dec 11 12:26:58 2004