On Linux machine with ext4 filesystem important file was accidentally deleted, file size was nearly 1 Gb to 2 Gb. After that, filesystem was used a short time, but the data of file still remains on disk, as I ensured later.
The file is modular and basically is a sequence of text pieces, and of particular interest for recovery are the latest pieces of the file.
I have other, much older version of the file on another computer, I have taken a specifically unique snippet from it and searched it with binary search within disk data using command
dd |grep -ova "unique-string-from-older-file-version".
As data was found, it turns out all interested pieces of file are still there on disk. So I have calculated the inode number for my data on the disk using easy formulas for ext4 filesystem. Next task is to find all related inodes, traversing up over inodes tree.
And I searching for utility, which will is able to recover file by its inode instead of by its name as usual software does.
Simple recovery procedures using several utilities did not succeed:
When reviewed containing directory with debug2fs it turns out that the directory entry is absent and that is why the 'undelete' command in debug2fs was not successful.
So the all interested data is still there, but it is unavailable.
What I'm looking for, is a software that will
- take on entry inode number
- find a specific chain of data to which the given inode belongs
- dump data of a whole found chain of inodes, to which my (other) specified inodes belongs to
Are there any ready software for that?