LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 08-19-2011, 09:49 PM   #1
willsam100
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Rep: Reputation: 0
Unhappy How to restore deleted inodes using debugfs


Using the find function and the delete option I deleted all the files in my 140gb partition

I do not have enough free space to restore the file using programs like photoRec which I have ran but the output put was files that were corrupted.

I have searched google and forums and have found out how to use debugfs. Running it on my unmounted partition I can see the deleted directories and files with ls -d. Running lsdel shows no files. I can also run stat on the deleted inode and it prints the details about the inode.

Does anyone know how to restore these inodes 'in place' effectively creating a link to the files again without destroying the data and without having to copy it to another drive/partition?

Debugfs has an undel flag but I don't really know what I'm doing with it. Also read that I have to run it with e2fsck. Is this possible without loosing the rest of my files?

Last edited by willsam100; 08-19-2011 at 09:50 PM.
 
Old 08-19-2011, 10:41 PM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,206

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
Are we to assume ext[234] ?
First things first - take a (dd) backup. Disk is cheap; go buy another in need.

Have you read this ?. There is a later utility extundelete. I haven't tested it yet.
 
Old 08-19-2011, 10:55 PM   #3
willsam100
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Original Poster
Rep: Reputation: 0
the partition is ext4 (i was mean to put that in my first post). after doing my searching makes the process a little more difficult.

As i am a student it is not possible for me to buy another hdd. I am considering deleting some other files that are not as important to free up enough space to create an image.

Yes i had flicked over the first page that posted and will have another read in more detail, thanks. I had checked out the extundelete utility before posting however everyone has said that they have not tested it. I ran into the following problem when running make:

make -s all-recursive
Making all in src
extundelete.cc: In function ‘int load_super_block(struct_ext2_filsys*)’:
extundelete.cc:944:47: error: invalid use of incomplete type ‘struct opaque_ext2_group_desc’
/usr/include/ext2fs/ext2fs.h:211:8: error: forward declaration of ‘struct opaque_ext2_group_desc’
extundelete.cc:944:47: error: no match for ‘operator=’ in ‘*(group_descriptor_table + ((unsigned int)(n * 32u))) = * fs->struct_ext2_filsys::group_desc’
/usr/include/ext2fs/ext2_fs.h:137:1: note: candidate is: ext2_group_desc& ext2_group_desc:perator=(const ext2_group_desc&)
make[2]: *** [extundelete-extundelete.o] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

I can try to figure out some problems, but this looked to big for me to debug and so i decided to give up on this utility (unless it is easy fix?).
 
Old 08-19-2011, 11:41 PM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,206

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
Do you have all the pre-reqs mentioned ?. Principally e2fslibs-dev I would imagine.
I see several positive posts on the web - looks good actually. If I get bored over the weekend I'll pull it down for a quick run.
 
Old 08-19-2011, 11:47 PM   #5
willsam100
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Original Poster
Rep: Reputation: 0
thanks for your reply. yes i did make sure that i have all of them installed. from my understanding there were two requirements e2fslibs and e2fsprogs, as well as the development version of each. I installed e2fslibs-dev assuming that was the development version. e2fsprogs did not have a dev option and i could not seam to find the development version only e2fsprogs-dbg which is debugging? I installed it anyway. I did all this before trying to install extundelete and then getting the output listed above
 
Old 08-20-2011, 01:12 AM   #6
willsam100
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Original Poster
Rep: Reputation: 0
So I played around and did a bit of further searching on extundelete and managed to install it using apt-get (not sure why this did work the first time installed it).

The downside is that it does not appear to be successful in recovering the files. When running using option --restore-all nothing happens, both on the partition and there are no files restored to its default directory (RECOVER_FILES).

I did run --restore-inode and gave it an inode (the inode was a directory). Noting happend and now I can not see that inode listed when running ls -d in debugfs. Also I can't see the inode that I gave it anywhere. I have a saved txt file of the output of ls -d from debugfs.
 
Old 08-20-2011, 03:44 AM   #7
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,206

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
Okay, I just had a play. Did everything you did, including the "find ... -delete"
Have a look for the RECOVERY_FILES in the working directory of the user you used to run the extundelete command - not on the subject disk/partition. Worked fine for me (Fedora 15).
 
Old 08-20-2011, 05:33 AM   #8
willsam100
LQ Newbie
 
Registered: Feb 2011
Posts: 6

Original Poster
Rep: Reputation: 0
Ok so i had another go as you said. This time it printed Out saying that it was unable to restore inode, the inode number and then the name of the directory then : No Data. There was data in this directory prior to the delete. A
So after looking in the recovered_FILES dir there was nothing.

Running debugfs I can still find the deleted inodes with ls -d. Below is the stat output of the inode that was printed out with extundelete.

Inode: 2752521 Type: directory Mode: 0600 Flags: 0x80000
Generation: 3721224587 Version: 0x00000000:00000008
User: 1000 Group: 1000 Size: 0
File ACL: 0 Directory ACL: 0
Links: 0 Blockcount: 0
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x4e4b1371:9c020ff4 -- Wed Aug 17 13:03:45 2011
atime: 0x4e49c2a0:cabff3fc -- Tue Aug 16 13:06:40 2011
mtime: 0x4e4b1371:9c020ff4 -- Wed Aug 17 13:03:45 2011
crtime: 0x4dc900d0:b2307f68 -- Tue May 10 21:09:36 2011
dtime: 0x4e4b1371 -- Wed Aug 17 13:03:45 2011
Size of extra inode fields: 28

The size is reported as being 0. Does this mean that the data could be gone?
 
  


Reply

Tags
deleted, file recovery, inode


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Deleted files recovery, inodes and size is known Fracker Linux - Newbie 3 04-29-2011 04:47 AM
debugfs shows 0 deleted inodes found, however there're some... jaggy00 Linux - Security 3 06-06-2007 06:52 PM
Restore deleted files Winanjaya Linux - Newbie 5 01-09-2007 01:23 AM
how to restore deleted files? ice99 Linux - Security 13 04-13-2006 03:10 AM
how to restore deleted files ? ilyes Linux - General 3 08-01-2003 07:13 AM


All times are GMT -5. The time now is 04:42 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration