Hi: I have just deleted some lines from a text file in vim, saved and quit, but accidentally. To get those lines back, given the backup is identical with the original file, I could use dd if I knew where the file is located on disk. But this information is kept in the inode so, so there is a way to get back lost data. How can I do it? Please do not suggest the use of some monster program. I only need to know the physical sector number of an existent file starting point.

Well, the data is irretrievably lost. I ran hadparm --fibmap which gave the start of the file and dd to extract it. If fills 8 sectors, of which vim only used 5. The rest is filled with zeros. My data was overwritten with the zeroes. Bad luck.

EDIT: who zeroed the rest of the block? Vim or the OS?
EDIT EDIT: On second thought it would be unlikely that Vim would to that. The zeroing of the rest of the block had to be managed by the OS itself. I wonder why? I do not see the need for clearing the rest of the block.

Thank you sir, share with me this information.

When vim saves a file, it does not overwrite the original. It creates a new file and then, once that file has been written successfully, renames it over the original. The saved file uses a new inode and disk blocks, so the fibmap report on the saved file tells you nothing about where the original file was stored on the disk.

If done promptly, the debugfs utility might have allowed you to locate that original, now deleted, inode and recover the file content. By now, that data has likely been overwritten since some file allocators select from the free block list on a "last in, first out" basis.

1 members found this post helpful.

I see.