Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
You may have a chance with using ext3undelete. But if you have used the system since you deleted the file chances are high that the files are already overwritten, so unrecoverable.
The most important principle of data recovery is not allowing any writes to the partition where the files are on.
Are you still using the OS which you used to delete those files?
I turn off machine yesterday. But I try my command (first umount sda3):
#extundelete /dev/sda3 --restore-directory /home/user/Wideo/lost --after 1358323320
Only show and process deleted entries if they are deleted on or after 1358323320 and before 2147483647.
WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 1745 groups loaded.
Loading journal descriptors ... 29855 descriptors loaded.
Failed to restore file /home/user/Wideo/lost
Could not find correct inode number past inode 1835010
What you might be able to do is use debugfs to dump the data blocks for that directory and then examine the output with a hex editor. That should help you remap the photorec filenumbers to their original names. Beware that the directory may contain entries for older versions of files, and anything you've done in that directory may have overwritten some of what you need, so it's going to take some work to sort it out.
In /var/tmp/dirdata you'll see filenames in text, each preceded by some binary data including the inode number (little-endian). At least that's the case for ext2 and ext3. I haven't had occasion to look at the on-disk directory format variants for ext4. With a little luck and a lot of effort you may be able to restore the original names for most of those deleted files.