Share your knowledge at the LQ Wiki.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 04-24-2008, 05:55 AM   #1
LQ Newbie
Registered: Sep 2007
Posts: 1

Rep: Reputation: 0
Unhappy How to get deleted files inode from super block


We are trying to recover deleted files and directories from Linux filesystem, I had gone through some articles regarding recovery of deleted information.

According to them, when the files/directories are deleted from the system respective inodes link will be removed from the dentry and that inode will be marked as free under superblock without removing(freeing) the actual contents of the inode and data block.

So, I wanted to know about the deleted files/directories inode.

Or, the inodes which are marked as free under superblock

Please suggest or send me a sample code…

Old 04-24-2008, 08:35 PM   #2
LQ Addict
Registered: Oct 2003
Location: Australia
Distribution: MX 17
Posts: 5,299

Rep: Reputation: Disabled
not that I need to...but I believe you are supposed to use a live cd

see if any of these links from unSpawn help
Old 04-24-2008, 08:48 PM   #3
LQ Addict
Registered: Oct 2003
Location: Australia
Distribution: MX 17
Posts: 5,299

Rep: Reputation: Disabled
some reading suggests testdisk is very good....and thats on a number of live cds but sysrescuecd springs to mind. note testdisk is already on cd this is just the dox
Old 04-25-2008, 01:01 AM   #4
Junior Hacker
Senior Member
Registered: Jan 2005
Location: North America
Distribution: Debian testing Mandriva Ubuntu
Posts: 2,687

Rep: Reputation: 61
Stop using the drive containing the data.
Windows and MacOS X use a "even wear system" where they try writing to blocks with the oldest date it became free. This ends up writing to as much of the entire partition before overwriting deleted files starting from the oldest available contiguous set of clusters/blocks large enough to contain the entire file.
Linux file systems are not like that, although it's been a while since I've read in this area, but if I remember right, most of the Linux file systems use something like "super blocks" which can be compared to chopping up the partition into smaller chunks where you'll have data written in blocks containing a specified amount of sectors at 512B each, (512B user storage, the actual sector size can vary depending on hard drive manufacturer's layout structure, could be 600B + - ). And files deleted in a super block layout get overwritten a lot faster than a file deleted from a vast partition storage scheme using even wear strategy.

Your best bet with a Linux file system is the sleuthkit for producing inode information, deleted file's inodes etc.
1 members found this post helpful.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
How to access inode of a deleted file? ashwyn222 Linux - Newbie 3 02-13-2008 05:36 AM
File system inode hardware block PatrickNew Linux - General 2 08-24-2007 08:08 AM
need to recover data in a deleted inode wilsonsamm Linux - General 6 08-30-2006 12:34 PM
Super Block surficialgolem Linux - Hardware 1 12-08-2005 08:51 AM
How can I format my ext3 partition to use 1024 byte blocks and 1 inode per block? abefroman Linux - Hardware 1 11-27-2005 12:01 AM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 12:31 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration