26292 total geeks with 3498 solutions

Recent challengers:

UserZero level 1 - 11:38PM
Tyranus level 2 - 02:21AM
Tyranus level 1 - 01:44AM

Welcome, you are an anonymous user! [register] [login]

	GEEK
Challenge Bonus Levels Geek Reverser View Solutions Test Centre Hall of Brain Hall of Bonus Hall of Reverse Geek or Freak

User's box

Username:

Password:

Forgot password?
New account

Shoutbox

	MaxMouse It's Friday... That's good enough for me!
	CodeX non stop lolz here but thats soon to end thanks to uni, surely the rest of the world is going good?
	stabat how things are going guys? Here... boring...
	CodeX I must be going wrong on the password lengths then, as long as it was done on ECB
	MaxMouse lol... the key is in hex (MD5: of the string "doit" without the "'s) and is in lower case. Maybe i should have submitted this as a challenge!

Donate

Donate and help us fund new challenges

Due Date:	May 31
May Goal:	$40.00
Gross:	$0.00
Net Balance:	$0.00
Left to go:	$40.00

Contributors

News Feeds

The Register

	Phones for the elderly: Testers wanted for senior service
	Lego X-wing fighter touches down in New York"s Times Square
	Experts: Network security deteriorating, privacy a lost cause
	Internet cafés declared "illegal businesses" in Ohio
	SAP shuffles execs to chase cloud success
	AT&T adds 61¢ "Mobility Administrative Fee" for users
	Microsoft caves to Google, pulls YouTube app from WinPhone Store
	Amazon expands Appstore reach, gives devs more user data
	Now it gets serious: Fracking could RUIN BEER
	Reports: New Xbox could DOOM second-hand games market

Slashdot

	How the Smartphone Killed the Three-day Weekend
	Spain"s New S-80 Class Submarines Sink, But Won"t Float
	Can the Wii U Survive Against the PS4 and Xbox One?
	World"s Biggest "Agile" Software Project Close To Failure
	Google Unable To Keep Paying App Developers In Argentina
	Ex-Marine Detained Under Operation Vigilant Eagle For His Political Views Sues
	European Commission Launches $12 Billion Chip Support Campaign
	Scanner Identifies Malware Strains, Could Be Future of AV
	AMD Launches New Mobile APU Lineup, Kabini Gets Tested
	How To Hack Twitter"s Two-Factor Authentication

Article viewer

File recovery on a linux Ext2 filesystem

Written by:	jake_null
Published by:	DeMoNiCoN
Published on:	2004-03-03 12:34:15
Topic:	Linux

Search OSI about Linux.

More articles by jake_null.

viewed 44208 times

Everyone hates it when they deleted something they absolutely needed and aren't quite sure how to get it back. Here is a fast and dirty way to recover files in a Ext2 Linux environment.

There is quite a few of ways to undelete or recover a file from a Ext2 file system. A popular project is unrm or e2undel but this program requires the user to un-mount the file system that the lost file was on. Although it may be easier to undelete files with e2undel mainly because it has a library to undelete by filename, you still have to download and install/configure it. For various reasons this may be an inconvenience and prove to be unnecessary with this article. Most linux distos come with a utility called debugfs and usually in a package called e2fsprogs or something similar. This is the tool we'll be using today. To start us off its usually a good idea to read the man page

[root@Hephaestus ]# man debugfs

Ok, now that you gave the man page a quick read you should have a bit of an idea of what we are gonna be doing.
First thing to do is mount your partition you can do this two ways.

[root@Hephaestus ]# debugfs /dev/hdaX

-OR-

[root@Hephaestus ]# debugfs
debugfs: open /dev/hdaX

Nothing amazing here. Now what we want to do is list out all the deleted files. (on a large partition this could take some time)

debugfs: lsdel

These files will not be listed as nicely as you'd hope. Instead they are listed in a much now technical way.
Inode Owner Mode Size Blocks TimeDeleted
Some of these words will be obvious to you if you've read up on hard drives and how they function.

Inode - inodes are data structures that contain information about files in Unix or unix like file systems. Each file has an inode and is identified by an inode number in the file system where it resides. inodes provide important information on files such as user and group ownership, access mode (read, write, execute permissions) and type.
inodes are created when a file system is created. There are a set number of inodes, which indicates the maximum number of files the system can hold. A file's inode number can be found using the ls -i command, while the ls -l command will retrieve inode information

Owner - The UID number of the user who owned the file. You can compare this to your /etc/passwd file to figure out what user the UID belongs to (<name>:x:<number>:..)

Mode - This is the mode of the file, be it a directory file and their permissions.

Size - The size of the file

Blocks - The number of blocks the file is on. In data management, a block is a group of records on a storage device. Blocks are manipulated as units. For example, disk drives often read and write data in 512-byte blocks.

TimeDeleted - The date of which the file was deleted.

Definitions from (www.webopedia.com)

Here is an example of lsdel's output

...
2048260 0 100644 27165 7/ 7 Sat Nov 29 21:10:09 2004
2048261 0 100644 248 1/ 1 Sat Nov 29 21:10:09 2004
2048262 0 100644 4066 1/ 1 Mon Feb 2 12:42:32 2004
784 deleted inodes found.
debugfs:

Now if you just deleted the file 15 seconds ago it wont be hard to figure out what inode your file was on by checking the closest date to the current date If its an older file chances of a successful recovery are lower. If you can remember the date and size you can narrow down the inodes you'll dump. Depending on the type of file and its contents you accidentally deleted you can use the cat command.

debugfs: cat <2048262>
This is the contents of the deleted file
debugfs:

If you know some of the text the file contained it will be easy to find which inode was your file. If it was something that the contents wouldn't make sense eg a compiled binary. Then you should use the dump command. This is also the command you'll use to recovery your file no matter its contents.

debugfs: dump <2048262> /home/jake/recovery.file
debugfs:

All that's left to do is quit debugfs (type q or quit) and go check out your file. Hopefully everything worked out fine. If you didn't read the debugfs man page there are quite a few useful commands to play around with.

Other File Systems
Ext2 - For a larger HOWTO check out Here
Ext3 - I've heard some people say you can treat it as an ext2 fs but i havent seen it done.
Reiserfs - If you run reiserfsck with option --rebuild-tree, it will
rebuild the tree, and probably relink your deleted files. Read the man page first!
Windows - Theres like 1000 shareware programs, google it.

Did you like this article? There are hundreds more.

Comments:

SAJChurchey
2004-03-03 15:03:58

Well Ext3 is just Ext2 w/ a Journal attached. The file system itself hasn't changed. There is just a form of "record keeping." This method may very well work on it. I'm a ReiserFS user myself so I don't really have the opportunity to try it out.

aidan
2004-03-03 17:42:20

In windows you can use powerquest "lost and found". Not sure if it supports NTFS tho.

bb
2004-03-03 21:10:10

OO Unerase for windows is cheap/free and highly recommended

ReKleSS
2004-03-04 04:37:17

I just tried this method under ext3, it doesn't seem to work - I can see the deleted blocks (three, for a 20 character file), but cat'ing them returns garbage.
-ReK

kregis
2008-08-19 07:08:46

Hi,
You can recover your ext2 or ext2 partition with the help of stellar phoenix Linux recovery software. This software can recover deleted, formatted data, files, folders & volumes from Ext2, Ext3 and Reiser FS of Linux operating system. More information on http://www.data-recovery-linux.com

Anonymous
2009-10-23 23:52:59

ext3 zeroes out the inode, making it almost impossible to recover... ext2 just marks it unused. Unless you use an ext3 partition mounted as ext2, the data on ext3 won't be recoverable using these means.

Anonymous
2011-01-05 08:17:06

url]链接: xiaolin

Anonymous
2011-01-05 08:17:51

a>链接: <a href="http://256.1.vg">xiaolin</a> New a>链接: <a href=http://256.1.vg>xiaolin</a> url]链接: xiaolin a]链接: [a/]http://256.1.vg[a]xiaolin[/a] link]链接: [link=http://256.1.vg]xiaolin[/link]纯链接: http://256.1.vg/others.html xiaolin リンク>链接: <リンク:http://256.1.vg>xiaolin</リンク>

ObatAsamUrat
2011-06-16 07:42:49

You undoubtedly help it become look simple using your business presentation nevertheless I have found this specific subject matter to get genuinely an issue that I do think I'd personally certainly not recognize. This indicates way too challenging and intensely vast to me. We are impatient for your upcoming article, Let me try and receive the practice the idea!
obat asam urat

Anonymously add a comment: (or register here)
(registration is really fast and we send you no spam)

BB Code is enabled.

Captcha Number:

Blogs: (People who have posted blogs on this subject..)

start svn on system boot in debian on Tue 21st Jul 10am
http://linux.justinhartman.com/Startup_S cript_for_Subversion I found this a really simple explanation of how to start svn when the server boots

SSHFS: Super Easy File Access over SSH on Wed 18th Feb 1pm
This was really useful, and worked great to communicate between servers. http://www.linuxjournal.com/article/8904 Thanks to gabbs

hellanzb nzb news downloader for NSLU2 on Tue 22nd May 7pm
Someone introduced me to the joyful NZB file recently. Its truly a wonderful invention, and allows my to explore usenet binary grabbing using my NSLU2. as previous nntp readers id tried made the process too painful. So simply .... 1) apt-get inst

edna mp3 streaming for nslu2 on Wed 9th May 11am
I've been streaming music from my home NSLU2 server for a while now using mt-daapd (firefly) which is an ITunes server for linux. I can connect to my home network from work using ITunes and a little daap proxy app called rendevous. My friend was doing

Adnurak

How to choose the right Linux Distro on Thu 9th Nov 7pm
This is mainly for new users who want to try out Linux for the first time, but try it out if you're experienced in Linux anyway, it's kinda fun. What with all these different distributions of Linux that you hear about all the time, it's hard to choose

ketan404

my blog on Thu 9th Nov 6am
http://ketan404.blogspot.com

Tweaking Apache and Mysql for Low Memory on Fri 20th Oct 11am
i implemented this to tweak my apache/mysql for better performance on my NSLU2. Hard to tell if its helping much though ;-) Mysql really doesnt run too well with apache on NSLU2 so I dont use it for much. http://www.unixshell.com/wiki/index.php/ Optimiz

Adnurak

Fate - A Linux Security Simulation Written in C++ on Fri 20th Oct 6am
Fate is a simulation of a Linux system written in C++ and meant for DOS (runs fine in winxp and winme by just doubleclicking) that according to the creator, m101, shows you the basics of security in different Linux systems, including but not limited to, M

Article on building rtorrent for arm5vtel NSLU2 with debianslug on Thu 19th Oct 7am
I wrote an article today on my efforts at compiling rtorrent for debianslug. its here ... Article on building rtorrent/libtorrent for arm5vtel NSLU2 with littleendian debianslug

How to mount .iso file on NSLU2 running debianslug on Tue 19th Sep 12pm
If like me your running debianslug on an NSLU2 and you'd like to mount an iso file so it can be directly streamed to Xbox Media Centre (its a beautiful solution isnt it!) then simply do the following. Ensure you have loop support in your debianslug k

Test Yourself: (why not try testing your skill on this subject? Clicking the link will start the test.)

Linux Test Simple by a13x4nd7u

This is a simple Linux commands test.

Linux Quiz by abhijangda

Trivia about your favorite OS

Linux Administration by typedeaF

Testing your knowledge of Linux administration tools, very light shell scripting, and good high level understanding of how the OS works at the user level. Anyone who has worked with Linux for 1-3 years should do good.

Linux Commands (Part 1) by nirus

If you think you know the linux command-line then this test is for you. For reference purposes, it is based on Debian/GNU Linux with a BASH Shell.

Your Ad Here