I've moved a 5G file from one drive to another. After it's moved, turned out the destination drive has some hardware problem and the file is corrupted and the file on the original drive was deleted since the mv is completed. I should be able to recover it from the original drive since it is unmounted once the mv is done. I've tried extundelete but it only works on ext3 and ext4. I've tried testdisk but it doesn't see it. After some research, I am able to see it with debugfs (file attached). To recover the file, I can either reset the inode, block and dtime flags, or copy those blocks to another drive with dd. The problem is there are quite a lot of them and not all of them are continuous and I'm not good in scripting to do it. Is there any utility can do the recovery? Or any guru can help me with a script to recover the file?

Attached Files

restore.txt (68.2 KB, 27 views)

I've only ever used PhotoRec, but it does work somewhat on deleted files. The case you cite seems to be ideal, you have the drive unmounted and haven't tried to write anything else to it as yet. A thing to check is whether or not PhotoRec can work on a limited directory on the drive it is searching, because it takes a long time and since it does not try to resurrect the directory structure, it will put together all file fragments it can and put them into many numbered sub-directories, so you'll get a lot of formerly deleted files back that you may not care about.

Does the "undelete" command in debugfs ("undelete <24577>") not work for that inode? It looks like enough information is there.

Try testdisk also. You don't have much support in ex2 for this sort of recovery by design (or lack of design)???

That should work as I figured out using dump_inode -p <24577> to recover it. Didn't try undel yet before backing up that drive.