xfs
[Top] [All Lists]

Re: How to undelete a file?

To: Friedrisch Muller <friedrischm@xxxxxxxxx>
Subject: Re: How to undelete a file?
From: Walt H <waltabbyh@xxxxxxxxxxxxxx>
Date: Sat, 09 Feb 2002 09:00:33 -0800
Cc: linux-xfs@xxxxxxxxxxx
References: <20020209103055.43335.qmail@xxxxxxxxxxxxxxxxxxxxxxx>
Sender: owner-linux-xfs@xxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.8) Gecko/20020204
Unfortunately, from what I recall, there's not an easy way to recover deleted files short of having a good, recent backup around. Check out:

http://marc.theaimsgroup.com/?l=linux-xfs&w=2&r=1&s=undelete&q=b

for more info on the subject.

-Walt

Friedrisch Muller wrote:
Hi,

I've accidentially deleted a file on my XFS 1.0.2
filesystem under RedHat Linux 7.2 2.4.9-21 i686.

I know the exact name of the file and the exact place
of the file in the directory tree. After the
accidential "rm myfile.txt" I directly unmounted the
filesystem.

Is there a way to get it back?
For example under Linux ext2fs it is quite easy (this
is documented in a mini-howto from linuxdoc):

1. Unmount the filesystem.
2. Start "debugfs".
3. Walk to the directory.
4. Dump the directory content data
   (debugfs: dump <inode of directory> /tmp/dirdata).
5. Exit debugfs.
6. Load the data into a hexeditor.
7. Check the inode of my deleted file (it is still
there in the directory data, only the "pointer" to the
next entry in the directory has increased so it now
points after my deleted file's directory entry).
8. Start debugfs again.
9. Add the file to a directory under a certain name
with the old inode number (debugfs: modify_inode
<inode of my deleted file>)
10. Set deletion time to 0 and link count to 1.
11. Dump my deleted file
(debugfs: dump <inode of my deleted file> /tmp/mydeletedfile)

Please, help...

     Regards / Friedrisch

__________________________________________________
Do You Yahoo!?
Send FREE Valentine eCards with Yahoo! Greetings!
http://greetings.yahoo.com





<Prev in Thread] Current Thread [Next in Thread>