LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-02-2010, 10:26 AM   #1
mckinnon81
LQ Newbie
 
Registered: Feb 2010
Location: Brisbane, QLD
Distribution: Ubuntu, Debian
Posts: 7

Rep: Reputation: 0
Trying to recover a deleted file.


Hi;

I am trying to recover a file that was deleted via fsck.

Running debugfs shows that the file is still possibly available:

Code:
5333037   40755 (2)   1000   1000    4096 16-Apr-2010 16:30 .
5332995   40755 (2)   1000   1000    4096 12-Apr-2010 10:08 ..
      0       0 (1)      0      0       0                   Windows XP.vdi
But with out an indode I cannot undelete it via debugfs

Using debugfs i did a dump of the directory the file was in.

Code:
 5332995   40755 (2)   1000   1000    4096 12-Apr-2010 10:08 .
 5332994   40755 (2)   1000   1000    4096 30-Apr-2010 09:44 ..
 5333037   40755 (2)   1000   1000    4096 16-Apr-2010 16:30 HardDisks
 5341201   40755 (2)   1000   1000    4096 16-Apr-2010 16:29 Machines
 5332998  100600 (1)   1000   1000    2743 30-Apr-2010 08:57 VirtualBox.xml
 5333039  100644 (1)   1000   1000    1236 12-Apr-2010 10:08 compreg.dat
 5333040  100644 (1)   1000   1000   14142 12-Apr-2010 10:08 xpti.dat

debugfs: dump <5333037> /tmp/dirdata

Now by using hexdump I can see the file exists but is not 'pointed' to.

Code:
#  hexdump -C dirdata

00000000  2d 60 51 00 0c 00 01 02  2e 00 00 00 03 60 51 00  |-`Q..........`Q.|
00000010  2c 00 02 02 2e 2e 00 00  00 00 00 00 20 00 16 01  |,........... ...|
00000020  2e 57 69 6e 64 6f 77 73  20 58 50 2e 76 64 69 2e  |.Windows XP.vdi.|
00000030  33 38 68 70 67 65 00 00  00 00 00 00 c8 0f 0e 01  |38hpge..........|
00000040  57 69 6e 64 6f 77 73 20  58 50 2e 76 64 69 00 00  |Windows XP.vdi..|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000
By using this hex how can i find the previous inode to modify as mentioned here:

For example under Linux ext2fs it is quite easy (this
is documented in a mini-howto from linuxdoc):

1. Unmount the filesystem.
2. Start "debugfs".
3. Walk to the directory.
4. Dump the directory content data
(debugfs: dump <inode of directory> /tmp/dirdata).
5. Exit debugfs.
6. Load the data into a hexeditor.
7. Check the inode of my deleted file (it is still
there in the directory data, only the "pointer" to the
next entry in the directory has increased so it now
points after my deleted file's directory entry).
8. Start debugfs again.
9. Add the file to a directory under a certain name
with the old inode number (debugfs: modify_inode
<inode of my deleted file>)
10. Set deletion time to 0 and link count to 1.
11. Dump my deleted file
(debugfs: dump <inode of my deleted file> /tmp/mydeletedfile)


Thanks
 
Old 05-02-2010, 11:56 PM   #2
mckinnon81
LQ Newbie
 
Registered: Feb 2010
Location: Brisbane, QLD
Distribution: Ubuntu, Debian
Posts: 7

Original Poster
Rep: Reputation: 0
BUMP

Anyone have any ideas?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Can I recover a deleted file in Linux ? josedsilva Linux - General 9 01-05-2010 08:49 AM
Need help to recover Deleted file - (file was saved in doc) Pravab Ubuntu 2 08-17-2008 11:57 AM
How to recover libc.so.6 file if it's deleted accidentally? tebet11@yahoo.com Linux - Distributions 4 12-25-2006 09:13 PM
I have deleted a file thru rm can i recover it ricka343 Linux - General 2 06-27-2006 04:28 AM
How to recover deleted file v1nc3nt Linux - Newbie 5 05-23-2006 04:28 AM


All times are GMT -5. The time now is 06:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration