1

On Linux machine with ext4 filesystem the important file was accidentally removed, size 1-2 Gb. After that, filesystem was used a short time, but the data of file still remains on disk.

The file is modular and is basically a sequence of text pieces, and of particular interest in recovery are the latest pieces of the file.

I have an different version of the file on another computer, I gave taken a snippet of it and

I searched it with binary search (using dd |grep -ova) and found that the interested pieces of the file all are still there. So I have the inode number for my data on a disk.

Simple recovery procedures using several utilities did not succeed.

When reviewed containing directory with debug2fs it turns out that the directory entry is absent and that is why the 'undelete' command in debug2fs was not successful.

So the all interested data is still there, but it is unavailable.

What I'm looking for, is a software that will

  1. take as entry inode number
  2. find a specific chain of data to which the specific inode belongs to.
  3. dump data of a whole found chain of inodes, to which my specified inode(s) belongs to

Are there any ready software utility for that?

  • That's a very specific use case... – Thomas Weller May 4 at 15:20
  • Why it is so specific, I could automate inode search procedure, than all people who lost their file(s) will have inode to their data to recover. – Mna May 4 at 15:22
  • And that can be not only for ext4 but for many file systems like Winfows NTFS, Apple HPFS, etc – Mna May 4 at 15:24
  • Just IMHO. People will use recovery software like Recuva, Photorec or similar. If you're already at inode level, you know much more than the average user. The usual next 2 steps would be: a) take a full disk image, so that there's no risk that the HDD gets broken and unusable and b) work on a copy of that image so that you can't accidentally modify the image. Do you know Autopsy or Foremost? You might want not only google for "file recovery" but also "computer forensic tools". These are also good at finding deleted data – Thomas Weller May 4 at 15:36
  • I have automated that once, more or less as proof-of-concept but it worked quite well on ext2 and ext3. Never followed up afterwards, but it should still work on ext4 I guess – at least it's worth giving my ext3undel a try if you wish. No guarantees, though: code was last updated 11 years ago, but that's only the wrappers (shell scripting). The tools used for that should be fresh, at least some of them. – Izzy May 4 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.