[ale] How do I 'undelete' a file?

[Chris Ricker]

On Fri, 18 Jan 2002, Charles Marcus wrote:

> I knew I might do something dumb...

Here's a summary guide for undeletion that I wrote for a co-worker.  It's a 
little terse, but it might help.  It may or may not work for you, depending 
on if the blocks used by the file have been overwritten or not.

As root,

# export $PART=/dev/hda

(or whatever partition has the files to be undeleted)

# umount $PART

# echo lsdel | debugfs $PART > /tmp/lsdel.$PART

(assuming /tmp isn't on the umounted partition; what you're doing here is 
getting a listing of deleted inodes from the partition)

# vi /tmp/lsdel.$PART

(edit the list to include likely candidates, or leave them all if you're not 
sure)

# awk '{print $1}' /tmp/lsdel.$PART > /tmp/inodes

(ripping out inode #s)

# for baz in $(cat /tmp/inodes); \
do echo "dump <$baz> -p /tmp/recovered.$baz" | debugfs $PART; \
done

(iterate over the inodes and undelete them to /tmp/recovered.inode#; just 
look at /tmp/recovered.inode# files to see if any are what you wanted)

later,
chris


---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.