need to recover data in a deleted inode
I don't know whether "deleted inode" is quite correct, I'm not quite sure what that is even.
I finally finished the first two chapters of my book, and then I deleted it by accident :mad: Now I scanned that area of the disk and found out what inodes the files were in, but I can't figure out how to get it back still. I thought of using dd, but I don't know the absolute physical location of the files. How can you work this out? |
If it's a *.doc or *.txt type file, you might try recovering it with the program foremost. Just be sure to just search for doc type files (there's a cli option for that) so that you don't find all the other crap. You'll probably have to run it from a live CD or a separate filesystem...
|
No, it's plaintext. The filenames are ./intro/01, ./intro/02, ./intro/03, ./intro/04, ./chooseday/05, and so on until ./chooseday/10.
|
I'm pretty sure foremost will find those files. They'll be renamed some numeric combination though. You'll have to rename them once you recover them.
|
Thanks for your replies, everyone.
I got my files back :) Foremost scanned throguh my entire disk, making thousands of little files that I didn't want and had to sift through. I found it so frustrating that I didn't know which of these files I wanted, though I did know precisely where on the disk they were. I had their inode numbers which I found using debugfs. MY SOLUTION: as always, google is my friend. I searched for something like "how to dump data from an inode" and it came up with an app called lde (http://lde.sourceforge.net/). Using this I found my data and dumped them to files with ease. Thanks again. |
Glad to hear a success - I passed by there a year or so ago, but have never needed it.
One for the tool-box. |
Congratulations! Foremost does indeed scan the whole drive. The trick is to use the command line switch to only search for certain filetypes of bigger than a certain size.
But that other tool sounds like a good one to remember! |
All times are GMT -5. The time now is 12:32 AM. |