recover deleted directories
 

I have a usb drive that is a linux partition and I've lost several big directories on it, each one full of important files. I need a way to scan the drive and undelete the directories if that's possible. Bulk file recovery is no good in this case, I need the directory structures back as well. The drive is seperate to the OS and contains only saved data.
I tried photorec and scalpel some other programs but they all force you to copy unstructured data to another drive and I don't want that. What I want is undelete the files and directories in situ if they are still there. I don't care about loss of current visible files on the drive.
I have the drive plugged into a centos6 machine and I tried extundelete but that gave:
ERROR: The specified device does not have a journal file. This program only undeletes files from file systems with journals.extundelete: Operation not permitted when trying to load filesystem parameters
(grrrr.) This is puzzling because there are still visible files on the drive so I thought it must have a journal...I also tried debugfs and lsdel but it only found 1 inode at 1Mb (whatever that is).
is there any good program to scan and undelete these directories?

How did you "lose" the directories? Through corruption of the directory structure? Or by legal, though unintentional or misguided manual deletion? What filesystem type is the USB drive? Since you tried "extundelete" I assume it's some flavor of ext. Is it ext, ext2, ext3 or ext4? Have you written anything to the drive after the problem occurred? Have you tried any "recovery in place" (which might have written to the drive)? Is there any directory structure still visible on the drive? You mentioned some files are still visible, but what about directories? Were these visible files there before the deletion occurred, or have they been added since?

Note: The above questions are not so much to recommend a specific recovery strategy, but more to gain additional information to see if a recovery is even possible.

Unless you have lots of files and lots of directories and no way to figure out which files go into which directories, it may be easier to recover the raw files using photorec or similar, then manually create a new directory structure and manually put each file in it's place. Obviously this would not be workable if you have hundreds of directories and thousands of files.

What kind of partition is that, ext3, ext4 ?
Have you tried magicrescue and testdisk? What about dd(be very careful with this one)?
Here some info about inodes: http://www.linfo.org/inode.html

Regards

Try photorec.

I've never needed it, but I've heard good reports on it. Be sure to read the instructions at the link above first.

thanks for the responses here. I had the usb drive plugged into a nas device (linksys NSLU2) and it had several directories on it. The backup I was doing over the network went wrong and was taking ages so I stopped the backup, unplugged the drive from the nas and plugged it into the machine I wanted to back up and I ran Clonezilla on it and did a backup onto the usb drive. The backup appeared to work perfectly. But when I plugged the usb drive back in to the nas device my original directories were all gone. All that was there was the backup I'd just done with clonezilla which is one directory with files in it.
The usb drive is /dev/sdb1 and is ext2 based on the following commands:

# file -sL /dev/sdb1
/dev/sdb1: Linux rev 1.0 ext2 filesystem data (mounted or unclean)

# fsck -N /dev/sdb1
fsck from util-linux-ng 2.17.2
[/sbin/fsck.ext2 (1) -- /dev/sdb1] fsck.ext2 /dev/sdb1

since discovering this loss of data I haven't written anything to the drive. Through the night I ran photorec on it but it just found 6.3Gb of useless stuff with no directory structures.

My understanding is that Photorec will not restore your directory structure or file names. It does give you a chance to examine the files it finds and determine what's worth keeping.

If you had nothing on that drive that you don't have a copy of elsewhere, it's probably not worth the effort. fsck it, reformat, and start over.

It sounds like for whatever reason, Clonezilla nuked everything previously existing on your thumbdrive. I have never used Clonezilla, so I don't know why it would have done that, or if it was something that could have been prevented with different options to Clonezilla.

But bottom line: I think since Clonezilla wrote to the thumbdrive, you're in for a helluva time trying to pull the old files off of it now. Photorec might be able to get some stuff off, but as has already been mentioned you would have to manually rename each recovered file and manually recreate the missing directory structure. Not fun. And chances of 100% success are basically nil. Chances of much success at all are pretty low.

If I understood you correctly, your initial attempt was to do a backup to the thumbdrive while it was plugged into your NAS device. When that failed (took too long), you tried doing the backup a different way (or maybe that second thing was an entirely different backup). But, if these were backups, don't you still have the original files you were backing up? Just start over from scratch then. But I have a sneaking suspicion that the original files must no longer be available, otherwise why would you be asking about recovery techniques here? If you no longer have the original files, I'm not sure I have any suggestions for you at this point.

In the future, I would recommend alternating backups. Never overwrite your previous backup with a newer backup. I use A and B directory structures for my backups. Which directory gets written to is controlled by which directory has been writen more recently than the other - the oldest of the two direcories is the one that gets the current backup. So if any given backup craps out, I still have the other backup left intact. If a backup croaks and craps out "A", don't turn around and try it again on "B". That could spell disaster. Investigate what went wrong, and when you re-try the backup, do it to a temporary C directory. Even better would be to use A and B drives (rather than directories), but I haven't gone to that extra trouble (and expense) myself.

ironically the usb drive in question contained backup images of my various machines before they got nuked by clonezilla. Photorec found thousands of files but they were just junk. I've given up on this now, formatted the drive and I'll start again. It means backing up all the machines again but that's not the end of the world. This is the second time I've lost backups so the lesson I've learnt from this is to backup each machine twice, both on different drives which I'll do from now on.