home | list info | list archive | date index | thread index

Re: [OCLUG-Tech] file recovery

Marlene Harris wrote:
: I'm trying to recover some files which were accidentally deleted, then the
: trash was emptied as well. Nothing else was saved on the computer since
: then, and I have been trying to recover them with the debugfs command. I can
: see a number of deleted files, but not the directory the files were in,
: which was also deleted.
: 
: How can I go about recovering these files or the entire deleted directory.
: I'm not sure how the dump command works, or any other command that will
: recover them. I'm running Ubuntu 9.04.

This is a shot in the dark, but...

I'm assuming you're using ext3 and not ext4.  If you are, this is by far
the best resource I've found on undeleting files from ext3:

  <http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html>

Not only does it provide a utility that may help you out, it also explains
some fundamentals of the ext3 filesystem (and, really, Unix filesystems in
general), what happens when a file is deleted, and how to restore it.

If you're on ext4 (I'm not sure what the default is in Ubuntu), you may be
out of luck.  Though it seems that 'undelete' was a feature request for
ext4, I don't know if it made it in to the kernel.

If you're not sure if you're running ext3 or ext4, running 'mount' in a
terminal window will tell you the filesystem type of all mounted
filesystems.

(On a related note, the standard response at times like this is 'backups'.
(It's annoying, but they're worthwhile.)  If you, like most others, don't
have a place to store backups, I find that filesystem snapshots are a viable
replacement.  I believe that LVM has them; I don't know if Ubuntu uses LVM
or not, unfortunately.  Snapshots won't protect you against disk failure,
but they do protect you against accidental deletions.)

references