Linux Ext2fs Undeletion mini-HOWTO

• Index
• Introduction
• How not to delete files
• What recovery rate can I expect?
• So, how do I undelete a file?
• Unmounting the file system
• Preparing to change inodes directly
• Preparing to write data elsewhere
• Finding the deleted inodes
• Obtaining the details of the inodes
• Recovering data blocks
• Modifying inodes directly
• Will this get easier in future?
• Are there any tools to automate this process?
• Colophon
• Credits and Bibliography
• Legalities

9. Obtaining the details of the inodes

debugfs has a stat command which prints details about an inode. Issue the command for each inode in your recovery list. For example, if you're interested in inode number 148003, try this:

debugfs:  stat <148003>
Inode: 148003   Type: regular    Mode:  0644   Flags: 0x0   Version: 1
User:   503   Group:   100   Size: 6065
File ACL: 0    Directory ACL: 0
Links: 0   Blockcount: 12
Fragment:  Address: 0    Number: 0    Size: 0
ctime: 0x31a9a574 -- Mon May 27 13:52:04 1996
atime: 0x31a21dd1 -- Tue May 21 20:47:29 1996
mtime: 0x313bf4d7 -- Tue Mar  5 08:01:27 1996
dtime: 0x31a9a574 -- Mon May 27 13:52:04 1996
BLOCKS:
594810 594811 594814 594815 594816 594817
TOTAL: 6

If you have a lot of files to recover, you'll want to automate this. Assuming that your lsdel list of inodes to recover in is in lsdel.out, try this:

# cut -c1-6 lsdel.out | grep "[0-9]" | tr -d " " > inodes

This new file inodes contains just the numbers of the inodes to recover, one per line. We save it because it will very likely come in handy later on. Then you just say:

# sed 's/^.*$/stat <\0>/' inodes | debugfs /dev/hda5 > stats

and stats contains the output of all the stat commands.