I must say that I don't understand much of what you are saying. Probably, my knowledge in the subject is insufficient.
Thats the problem, I too lack sufficient knowledge, it appears that the EXT3 filesystem journals changes to files, for reliability - but it is not practical to do recovery of those changes.
From what I can tell, when an block within a file changes instead of overwriting existing block in place, it uses a new block and marks the old one for garbage collection/reuse and records the block pointer change (journals it). This means that, provided the trash hasn't been taken out, the data is there - it could be reconstructed. Those changes are recorded (old and new block pointers, timestamps, etc) in the journal that lives along side of the file, part of the file's metadata, the inode.
I guess (again my ignorance) the advantage is that if a write fails, or the system crashes during I/O the previous block pointers can be used to reconstruct the file using fsck and filesystem built-in capabilities.
Anyone have a better understanding of journaling in EXT3?
Last edited: