Hi;
I am trying to recover a file that was deleted via fsck.
Running debugfs shows that the file is still possibly available:
Code:
5333037 40755 (2) 1000 1000 4096 16-Apr-2010 16:30 .
5332995 40755 (2) 1000 1000 4096 12-Apr-2010 10:08 ..
0 0 (1) 0 0 0 Windows XP.vdi
But with out an indode I cannot undelete it via debugfs
Using debugfs i did a dump of the directory the file was in.
Code:
5332995 40755 (2) 1000 1000 4096 12-Apr-2010 10:08 .
5332994 40755 (2) 1000 1000 4096 30-Apr-2010 09:44 ..
5333037 40755 (2) 1000 1000 4096 16-Apr-2010 16:30 HardDisks
5341201 40755 (2) 1000 1000 4096 16-Apr-2010 16:29 Machines
5332998 100600 (1) 1000 1000 2743 30-Apr-2010 08:57 VirtualBox.xml
5333039 100644 (1) 1000 1000 1236 12-Apr-2010 10:08 compreg.dat
5333040 100644 (1) 1000 1000 14142 12-Apr-2010 10:08 xpti.dat
debugfs: dump <5333037> /tmp/dirdata
Now by using hexdump I can see the file exists but is not 'pointed' to.
Code:
# hexdump -C dirdata
00000000 2d 60 51 00 0c 00 01 02 2e 00 00 00 03 60 51 00 |-`Q..........`Q.|
00000010 2c 00 02 02 2e 2e 00 00 00 00 00 00 20 00 16 01 |,........... ...|
00000020 2e 57 69 6e 64 6f 77 73 20 58 50 2e 76 64 69 2e |.Windows XP.vdi.|
00000030 33 38 68 70 67 65 00 00 00 00 00 00 c8 0f 0e 01 |38hpge..........|
00000040 57 69 6e 64 6f 77 73 20 58 50 2e 76 64 69 00 00 |Windows XP.vdi..|
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00001000
By using this hex how can i find the previous inode to modify as mentioned here:
For example under Linux ext2fs it is quite easy (this
is documented in a mini-howto from linuxdoc):
1. Unmount the filesystem.
2. Start "debugfs".
3. Walk to the directory.
4. Dump the directory content data
(debugfs: dump <inode of directory> /tmp/dirdata).
5. Exit debugfs.
6. Load the data into a hexeditor.
7. Check the inode of my deleted file (it is still
there in the directory data, only the "pointer" to the
next entry in the directory has increased so it now
points after my deleted file's directory entry).
8. Start debugfs again.
9. Add the file to a directory under a certain name
with the old inode number (debugfs: modify_inode
<inode of my deleted file>)
10. Set deletion time to 0 and link count to 1.
11. Dump my deleted file
(debugfs: dump <inode of my deleted file> /tmp/mydeletedfile)
Thanks
