LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
LinkBack Search this Thread
Old 04-24-2008, 04:55 AM   #1
pramodhbm
LQ Newbie
 
Registered: Sep 2007
Posts: 1

Rep: Reputation: 0
Unhappy How to get deleted files inode from super block


Hello,

We are trying to recover deleted files and directories from Linux filesystem, I had gone through some articles regarding recovery of deleted information.

According to them, when the files/directories are deleted from the system respective inodes link will be removed from the dentry and that inode will be marked as free under superblock without removing(freeing) the actual contents of the inode and data block.

So, I wanted to know about the deleted files/directories inode.

Or, the inodes which are marked as free under superblock

Please suggest or send me a sample code


Pramodh
 
Old 04-24-2008, 07:35 PM   #2
aus9
Guru
 
Registered: Oct 2003
Posts: 5,055

Rep: Reputation: Disabled
not that I need to...but I believe you are supposed to use a live cd

see if any of these links from unSpawn help

http://www.linuxquestions.org/questi...408#post619408
 
Old 04-24-2008, 07:48 PM   #3
aus9
Guru
 
Registered: Oct 2003
Posts: 5,055

Rep: Reputation: Disabled
some reading suggests testdisk is very good....and thats on a number of live cds but sysrescuecd springs to mind.

http://www.sysresccd.org/Main_Page

http://www.cgsecurity.org/wiki/TestDisk note testdisk is already on cd this is just the dox
 
Old 04-25-2008, 12:01 AM   #4
Junior Hacker
Senior Member
 
Registered: Jan 2005
Location: North America
Distribution: Debian testing Mandriva Ubuntu
Posts: 2,687

Rep: Reputation: 59
First,
Stop using the drive containing the data.
Windows and MacOS X use a "even wear system" where they try writing to blocks with the oldest date it became free. This ends up writing to as much of the entire partition before overwriting deleted files starting from the oldest available contiguous set of clusters/blocks large enough to contain the entire file.
Linux file systems are not like that, although it's been a while since I've read in this area, but if I remember right, most of the Linux file systems use something like "super blocks" which can be compared to chopping up the partition into smaller chunks where you'll have data written in blocks containing a specified amount of sectors at 512B each, (512B user storage, the actual sector size can vary depending on hard drive manufacturer's layout structure, could be 600B + - ). And files deleted in a super block layout get overwritten a lot faster than a file deleted from a vast partition storage scheme using even wear strategy.

Your best bet with a Linux file system is the sleuthkit for producing inode information, deleted file's inodes etc.
 
1 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to access inode of a deleted file? ashwyn222 Linux - Newbie 3 02-13-2008 04:36 AM
File system inode hardware block PatrickNew Linux - General 2 08-24-2007 07:08 AM
need to recover data in a deleted inode wilsonsamm Linux - General 6 08-30-2006 11:34 AM
Super Block surficialgolem Linux - Hardware 1 12-08-2005 07:51 AM
How can I format my ext3 partition to use 1024 byte blocks and 1 inode per block? abefroman Linux - Hardware 1 11-26-2005 11:01 PM


All times are GMT -5. The time now is 07:50 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration