Warning while trying to recover a deleted directory with extundelete

milhan · 07-19-2018, 08:18 PM

hi,
I am using Fedora 28. My Desktop environment is LDXE. I accidentally deleted a directory with subdirectories and about 7gb data files. I am trying to recover them with extundelete utility but getting warning. I unmounted the filesystem, where the directory was, right away with

Code:

sudo umount /dev/mapper/fedora-home

when I try the command:

Code:

/ sudo extundelete --restore-directory /home/milhan/Desktop/path/directory /dev/mapper/fedora-home
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
n
/ sudo fsck /home
fsck from util-linux 2.32.1
e2fsck 1.44.2 (14-May-2018)
/dev/mapper/fedora-home is in use.
e2fsck: Cannot continue, aborting.

I get the above results.. Any help? Thanks.

MensaWater · 07-20-2018, 07:48 AM

You didn't unmount properly as it tells you.

To unmount you specify the directory/filesystem name NOT the filesystem device:
CORRECT:

Code:

sudo umount /home

INCORRECT:

Code:

sudo umount /dev/mapper/fedora-home

On the flip side you specify the filesystem device with fsck not the name:
CORRECT:

Code:

sudo fsck /dev/mapper/fedora-home

INCORRECT:

Code:

sudo fsck /home

milhan · 07-20-2018, 11:53 AM

Hi, thank you for the reply.

Code:

/ sudo umount /home
umount: /home: target is busy.
/ sudo umount -l /home
/ cd
bash: cd: /home/milhan: No such file or directory
/ sudo fsck /dev/mapper/fedora-home 
fsck from util-linux 2.32.1
e2fsck 1.44.2 (14-May-2018)
/dev/mapper/fedora-home is in use.
e2fsck: Cannot continue, aborting.

/

MensaWater · 07-20-2018, 03:45 PM

Run "df -hP /home" when you think it is unmounted. If it still shows the filesystem as /home instead of just / then it isn't unmounted.

The umount told you it was busy. You can see what is busying out a filesystem by running lsof on it e.g:
lsof /home

Since it is /home and you logged in as yourself it may be your own login that is busying out /home because you're in your home directory. You'd need to at least cd out of /home (e.g. cd /tmp) so you're not sitting in it.

"umount -l" is lazy unmount. It really should only be used for unmounting shared filesystem (e.g. NFS mounts) from other server to this one. Even then it should only be done if the mount has gone stale such as when the server that exported the share got shutdown or lost networking for some reason.

milhan · 07-20-2018, 04:24 PM

how do I unmount it then?

Code:

/ sudo umount /home                                                                                                                                                                                                 
umount: /home: target is busy.

syg00 · 07-20-2018, 05:58 PM

Easiest from single user mode, or use a liveCD.

milhan · 07-20-2018, 06:52 PM

Quote:

Originally Posted by syg00

Easiest from single user mode, or use a liveCD.

ok, booted single user mode, and here are the results:

Code:

/ extundelete --restore-directory /home/milhan/Desktop/path/directory /dev/mapper/fedora-home
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 3256 groups loaded.
Loading journal descriptors ... Segmentation fault (core dumped)

milhan · 07-21-2018, 07:56 AM

successfully unmounted /home and then ran a fsck successfully on single user mode. Then tried

Code:

extundelete --restore-all /dev/mapper/fedora-home

and again got segmentation fault.