recover deleted file btrfs

ixion22600 · 06-15-2015, 07:09 AM

Hi all,

How can one undelete a specific text file in btrfs?

os: opensuse 13.2
fs: /home filesystem
file: located in a directory in /home

please let me know if you have some examples available.

many thanks!

wagscat123 · 06-15-2015, 07:58 PM

If you have saved snapshots, you can use snapper to go back to a snapshot containing your lost files:
https://lizards.opensuse.org/2011/04...ucing-snapper/

Otherwise, you'll want to unount the partition, not write anything to it, and boot to a LiveCD and use a utility called "testdisk" (to prevent the file from being overwritten). You can get if from http://www.cgsecurity.org/ and through software.opensuse.org and possibly zypper. testdisk wasn't originally made for btrfs but it might be able to help you. The first few Google searches I skimmed through didn't have any better ideas.

JZL240I-U · 06-16-2015, 05:34 AM

I also read that "photorec" is very good at restoring files despite its somewhat misleading name. Never tried it myself and I believe it must be bought.

cepheus11 · 06-16-2015, 10:38 AM

No, photorec is part of the "testdisk" package. Photorec is the tool to use here, not testdisk. Testdisk only restores partition tables.

A filesystem debugger would be a more surgical tool to recover one particular deleted file, instead of all and then searching through them. But I don't know if there is such a debugger for btrfs, and filesystem debuggers require a hell of learning to use.

JZL240I-U · 06-17-2015, 01:00 AM

Ah, thanks for the clarification.

ixion22600 · 06-17-2015, 04:19 AM

Thanks guys for the posts. I was very lucky because there was a vi swp file and I managed to recover part of the code that I worked on

But for beying productive, what do you guys use to keep a automatic backup of your code/scripts and so on, what would be the method that works for you the best?

Thanks!

JZL240I-U · 06-17-2015, 04:24 AM

I use backintime which can be configured to all your needs I'd say (backintime on my home setup, work is automated by the IT-department every 3 hours). Btw. I thought vim can do versioning?

syg00 · 06-17-2015, 05:24 AM

You're using btrfs, take a snapshot. Takes no time, can be run anytime, and occupies (almost) no space.
Take a snap, back it up at your leisure while you are working.

For btrfs you'd better be conversant with the wiki - it has a page describing how to do your own incremental backups.

As to the original question, there are scripts on the net for recovering deleted (btrfs) files, but they are not foolproof. Use backups.