Using undel command in debugfs
 

Hi

How do I 'undel' a file with certain inode to main disk. Let say, I unmount /dev/hda2 (ext2fs), and open the disk with 'debugfs /dev/hda2' with read only option. And I want to save the file in my home directory in /dev/hda1. Then in debugfs I type 'undel xxxxxinode /home/chiichan/aaa.file'. It says cannot save file/or something like that, disk in readonly mode. Why it can't find the /home/chiichan in /dev/hda1? I already lcd to root directory and I also tried lcd to /home/chiichan. How do I pass the command so that it will save the undeleted file in my home directory instead of the current disk (/dev/hda2)? Help would be really appreciated:confused: . [Note: I can undel to the current disk if I use debugfs in read/write mode.]

"How do I pass the command so that it will save the undeleted file in my home directory instead of the current disk (/dev/hda2)?"

Here is my guess:

debugfs -R cat <inode#> > /home/chiichan/my.new.file

___________________________________
Be prepared. Create a LifeBoat CD.
http://users.rcn.com/srstites/LifeBo...home.page.html

Steve Stites

Thanks, I haven't tried it yet. Can it be something like this:

debugfs -R undel <inode#> /home/chiichan/xxx.file ?

Any other suggestions?

"debugfs -R undel <inode#> /home/chiichan/xxx.file ?"

needs another > to redirect standard output to a file.
debugfs -R undel <inode#> > /home/chiichan/xxx.file

My man debugfs does not show any undel command.

Here is an online man page for debugfs and it doesn't show undel either:

http://www.die.net/doc/linux/man/man8/debugfs.8.html

___________________________________
Be prepared. Create a LifeBoat CD.
http://users.rcn.com/srstites/LifeBo...home.page.html

Steve Stites

Hi

It is in my debugfs. I run the program> help and it list down the commands including undel command. However, I can't find the undel command in the man page. May be the man page is not updated.;)

Since you are using the read only option then you should not hurt anything on /dev/hda2. So I think that you should try the different possible debugfs commands and see if you can get one of them to work.

I read the debugfs -R help and it did not tell me much about undel. My guess is that undel changes an inode on /dev/hda2 so that the file is now existing again. I do not think that undel will work in read only mode. But it should not hurt anything to try undel in read only mode.

I think that first you should try to copy the deleted file to your home directory with cat. If you cannot get that to work then try undel in read only mode. If that does not work then try undel in write mode.

___________________________________
Be prepared. Create a LifeBoat CD.
http://users.rcn.com/srstites/LifeBo...home.page.html

Steve Stites

Hi

I tried the following commands:

debugfs /dev/hda2 cat inode_# > /home/chiichan/file

--> did not work, it said file name unknown; cat <file> <destination_file>

debugfs /dev/hda2 undel inode_# > /home/chiichan/file

-->did not work, it said should be without '>'

debugfs /dev/hda2 undel inode_# /home/chiichan/file

-->did not work, it said destination unknown

so I tried in debugfs prompt:

debugfs: cat inode_# > /home/chiichan/file

-->file name unknown, cat <file> > <destination_file>

debugfs: dump inode_# /home/chiichan/file

-->file name unknown, dump <file> <destination_file>

debugfs: undel inode_# /home/chiichan/file

-->destination unknown

debugfs: undel inode_# file

-->read only filesystem

So, I open /dev/hda2 in read-write mode:

debugfs: undel inode_# file

-->Successful

So, I the debugfs can't find the other filesystem other than the currently opened /dev/hda2. Using debugfs in read-write mode seem to be the only solution.