ralf(8) ralf(8) NAME R.A.L.F. - Recover A Lost File, a tool to undelete an (accidentally) deleted file from ext2/ext3 file systems SYNOPSIS ralf fileName [options] ralf --help Available options: [+d] [--debug] [-d] [--nodebug] [+s] [--silent] [-s] [--nosilent] [--freespace] [--wholespace] DESCRIPTION R.A.L.F. is a wrapper to a collection of tools needed for successfully recovery of files deleted from ext2/ext3 file systems. If you simply want to restore all deleted files from the entire file system, you bet ter use tools like PhotoRec or foremost directly (they simply restore everything they find, and you can restrict by file types and file sys tem only). Using tools like fls, fsstat and dls from the Sleuthkit, we can restrict further - and thats what Ralf does. Recovery of lost files from ext2/ext3 file systems is not that easy, and requires multiple steps. R.A.L.F. automates these steps, thus speeding up the recovery process. Based on the file name you provide on the command line, R.A.L.F. - checks on which device the file has been, selecting this as "Source Device" - asks the user to specify a device other than the source to restore to. Restauration must be done on a different device, to prevent the data from being overwritten during the restauration process - finds the range of file system blocks the file belongs to, and copies these blocks to an image file on the target device - runs PhotoRec (or foremost) to extract all files found in this image. We need to extract them all, since we cannot tell which one is the correct file Once the script has completed its tasks, it tells you the location where the recovered files are stored. Now the only task left to you is to finally identify the wanted file - and remove the rest (if not needed). However, keep in mind that R.A.L.F. may fail - which can be due to dif ferent reasons: - The data blocks (or even iNode) may already have been re-occupied by a newer file - file system corruption could be present - the script itself may be full of bugs... So we can give no guarantee but that the script (and its required com ponents) consume additional space on one of your disks, once you have them installed. You use it at your own risk - the authors cannot be made responsible for any negative results, damages, etc.pp. (you find these details in the license information, installed to the docs direc tory). OPTIONS --help Display some help (list syntax and available options) and exit. +d --debug Enable debug output. This is mainly used during development, but also useful to track errors to report -d --nodebug Disable debug output. You will usually not need this - unless you set DEBUG=1 in your configuration file. +s --silent Make the script less verbose by disabling most of the progress messages. Questions will be asked, though, if your input is needed :) -s --nosilent Enable progress messages. You usually will not need this switch - unless you set SILENT=1 in your configuration. --freespace Tell PhotoRec to recover only from free (currently unused) space. Has effect for PhotoRec 6.9+ only. --wholespace Tell PhotoRec to recover from the entire (used and unused) space. This may also include files which are not (yet) deleted. Has effect for PhotoRec 6.9+ only. CONFIGURATION Some basic configuration can be done in /etc/ext3undel/ext3undelrc (or $HOME/.ext3undel/ext3undelrc, after copying the file there), where you will also find a description on what they do. R.A.L.F. first tries to read its configuration from the global configuration, and then over writes them with the user specific ones (if found). MESSAGES AND EXIT CALLS R.A.L.F. uses exit codes according to the Linux specifications (see http://rute.2038bug.com/node7.html.gz, section 4.2). Basically these are here: Code Description 0 Everything went fine - or the user (= you) decided to answer "N" to some question on whether to continue 1 Operation not permitted (e.g. script run without root privi leges) 2 Some file was not found 19 (Source) device could not be determined Except for those, error codes from other programs called (such as Pho toRec or foremost) are simply returned by the script as well. FILES /etc/ext3undel/ext3undelrc /usr/bin/ralf /usr/share/doc/ext3undel/* SEE ALSO ext3undel.conf(5) gabi(8) ext3undel(8) http://projects.izzysoft.de/trac/ext3undel (Project page) AUTHOR This manual page was written by Andreas Itzchak Rehberg (devel@izzysoft.de), the author of the program. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2. More information may be found on the authors website, http://www.izzysoft.de/ 02 July 2008 ralf(8)