Messages in this thread | | | Date | Wed, 4 Dec 1996 19:05:57 -0500 | From | "Theodore Y. Ts'o" <> | Subject | Re: recover deleted files? |
| |
Date: Tue, 3 Dec 1996 17:08:17 -0500 (EST) From: Travis Woodbury <travis@rwii.com>
Does anyone know how I would go about recovering some deleted files?? Everything I have been told seems to indicate that it _should_ be possible (with lots of work) but nothing says how exactly to go about doing this. I have left the partition mounted read only since soon after having screwed up. (a MB or two did get copied to the partition before I realized what had happened). Partial recovery is much better then nothing at all.
Using the "lsdel" command in debugfs, you can get a list of recently deleted files on the filesystem. Using the "modify_inode" command (which granted is not very convenient if you want to undelete a lot of files), you can set the links_count field to 1, and then run e2fsck to recover the filesystem.
Note that due to a kernel limitation (which is lifted in the 2.1 kernels but which is present in 2.0 and older kernels) only the first 12k of a deleted file can be recovered in this way. Unfortunately, the way the unlink code worked in the 2.0 kernels destroyed the indirect block information.
- Ted
| |