File Recovery Caveats

Once in a blue moon someone will delete a file that should not be deleted. Without a backup of that file there is the possibility to "undelete" the file using specialized tools. In fact, if you can immediately stop all disk activity on the partition where the deleted file was located there is usually a pretty good chance that an undelete tool will be able to recover the file.

There are exceptions to that situation though. For example, Linux supports many different file systems, one of which is Ext3. According to this FAQ, undeleting files is not possible on Ext3 file systems:

Q: How can I recover (undelete) deleted files from my ext3 partition?

Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereasext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.

Interestingly enough I've found some tools on the Internet that claim to be able to recover data from Ext3 file systems. While I haven't tried any I suspect that what they do is recover data, and not necessarily whole files. That is, they might look at the disk directly for data that isn't overwritten and then you'd probably have to manually put the data back together, pieces at a time.

So a good backup plan is better route to take. People make mistakes. So don't make the mistake of waiting too long to implement your backup plan before someone else makes the mistake of deleting necessary files.