1

On Linux machine with ext4 filesystem important file was accidentally deleted, file size was nearly 1 Gb to 2 Gb. After that, filesystem was used a short time, but the data of file still remains on disk, as I ensured later.

The file is modular and basically is a sequence of text pieces, and of particular interest for recovery are the latest pieces of the file.

I have other, much older version of the file on another computer, I have taken a specifically unique snippet from it and searched it with binary search within disk data using command

dd |grep -ova "unique-string-from-older-file-version".

As data was found, it turns out all interested pieces of file are still there on disk. So I have calculated the inode number for my data on the disk using easy formulas for ext4 filesystem. Next task is to find all related inodes, traversing up over inodes tree.

And I searching for utility, which will is able to recover file by its inode instead of by its name as usual software does.

Simple recovery procedures using several utilities did not succeed:

When reviewed containing directory with debug2fs it turns out that the directory entry is absent and that is why the 'undelete' command in debug2fs was not successful.

So the all interested data is still there, but it is unavailable.

What I'm looking for, is a software that will

  1. take on entry inode number
  2. find a specific chain of data to which the given inode belongs
  3. dump data of a whole found chain of inodes, to which my (other) specified inodes belongs to

Are there any ready software for that?

5
  • That's a very specific use case... – Thomas Weller May 4 '19 at 15:20
  • Why it is so specific, I could automate inode search procedure, than all people who lost their file(s) will have inode to their data to recover. – Mna May 4 '19 at 15:22
  • And that can be not only for ext4 but for many file systems like Winfows NTFS, Apple HPFS, etc – Mna May 4 '19 at 15:24
  • Just IMHO. People will use recovery software like Recuva, Photorec or similar. If you're already at inode level, you know much more than the average user. The usual next 2 steps would be: a) take a full disk image, so that there's no risk that the HDD gets broken and unusable and b) work on a copy of that image so that you can't accidentally modify the image. Do you know Autopsy or Foremost? You might want not only google for "file recovery" but also "computer forensic tools". These are also good at finding deleted data – Thomas Weller May 4 '19 at 15:36
  • I have automated that once, more or less as proof-of-concept but it worked quite well on ext2 and ext3. Never followed up afterwards, but it should still work on ext4 I guess – at least it's worth giving my ext3undel a try if you wish. No guarantees, though: code was last updated 11 years ago, but that's only the wrappers (shell scripting). The tools used for that should be fresh, at least some of them. – Izzy May 4 '19 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.