LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-10-2013, 01:45 PM   #1
apink
LQ Newbie
 
Registered: Jan 2013
Posts: 12

Rep: Reputation: Disabled
recovering deleted file without intact inode


I am trying to recover some sqlite files that were deleted due to operator error. (Doh!) The files were on an ext2 partition of an sd card which has been imaged. Of five files deleted, four were recovered using debugfs -> lsdel then -> dump. The fifth file does not show up in the debugfs->lsdel list.

Other attempts have been made with foremost and photorec. Photorec has come the closest, recovering a portion of the file. Unfortunately lots of data is missing from the file.

From photorec I know the location (logical sector number ?) of the start of the file. The file is around 15 blocks long so I am assuming that it is spread out on the drive.

My questions:

1. Are there tools that piece together a file given the logical sector number of the beginning of the file?
2. I am guessing that since the inode of this fifth file does not show up in debugfs->lsdel that this particular inode was used for a new file after the deletion took place. But if this is not the case is there a way to search for inodes given the file's location?

Any answers or other suggestions are much appreciated. I have searched forums etc and am stuck.
 
Old 01-10-2013, 04:09 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,354
Blog Entries: 55

Rep: Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541
Quote:
Originally Posted by apink View Post
Other attempts have been made with foremost and photorec. Photorec has come the closest, recovering a portion of the file. Unfortunately lots of data is missing from the file.
Photorec, scalpel and foremost can only carve based on known file headers and footers. And AFAIK Sqlite files don't have a specific footer that terminates the database file.


Quote:
Originally Posted by apink View Post
Are there tools that piece together a file given the logical sector number of the beginning of the file?
An inode lists blocks in use by a file. But apart from those some hold addresses for other blocks: the secondary and tertiary indirect blocks. Once a files inode information gets reset the list of direct blocks is gone as well as any pointers to other blocks: so it's not a case of "walking a tree" across a file system. (On a side note this also means that anyone offering to have had "good results" with any product like St*ll*r Ph**n*x Linux Data Recovery most of the time de-cloaks as just an ordinary spammer trying to take advantage of victims of data loss. Those accounts get the care and attention they deserve.)


Quote:
Originally Posted by apink View Post
I am guessing that since the inode of this fifth file does not show up in debugfs->lsdel that this particular inode was used for a new file after the deletion took place.
A file gets listed in exactly one inode only so if the inum doesn't show up in 'lsdel' then its not used. Depending on the size of the SD, existing files and files recovered you could try zeroing out known files and hope the majority of the rest is the SQLite db contents you're looking for but if the db contains only plain text you might as well just grep the device for strings first...
 
Old 01-10-2013, 10:55 PM   #3
apink
LQ Newbie
 
Registered: Jan 2013
Posts: 12

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by unSpawn View Post

Depending on the size of the SD, existing files and files recovered you could try zeroing out known files and hope the majority of the rest is the SQLite db contents you're looking for but if the db contains only plain text you might as well just grep the device for strings first...
Thanks. I will start there. The sd contains lots of databases that look the same so zeroing out might be helpful.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
when is inode deleted from file system? m4rtin Linux - Security 2 03-08-2012 09:35 AM
Recovering a file deleted with rm. stf92 Linux - Newbie 2 12-22-2010 07:19 AM
Recovering a deleted file from its inode iliasjr Debian 1 08-08-2010 08:00 AM
LXer: Recovering Deleted Files By Inode Number In Linux And Unix LXer Syndicated Linux News 0 08-12-2008 05:41 AM
How to access inode of a deleted file? ashwyn222 Linux - Newbie 3 02-13-2008 04:36 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 12:39 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration