undeleting files (on ext2 filesystems)
- stop in your tracks, do as little as possible with your files
- let's assume you deleted some files from /home/myaccount/source
- find out which partition the deleted file is on. For example, run df, and see that /home is a directory under /, which lives on /dev/hda5 (all examples, your case may be different)
- su to root
- for safety, umount /dev/hda5 (this may not be possible though)
- change to a directory on a different partition (/boot for example), and create a temp directory there
- run debugfs /dev/hda5
- at the prompt, run lsdel. It will list inode, owner, mode, size, blocks & time of all deleted files on that partition. This list could be long. Near the bottom are your recently deleted files. You'll recognize them by the id (run id to find out your account's id number), filesize, deletion time. Note the inodes of the files you want to recover.
- run dump <inode> /boot/temp/filename for each file you want to recover. Note: you need the angled brackets around the inode number!
A program which has a more sophisticated interface for doing this is
e2undel (still have to try it out).
Send me your comments!
Something didn't work as expected? You'd like to add some useful info to this tip? Use the form below to send me your comments. (Don't forget to fill out the super-lame CAPTCHA below..)