A step-by-step guide for recovering files using debugfs
[root@unix-support-server ~]# mount
/dev/sda2 on / type ext4 (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) devpts on /dev/pts type devpts (rw,gid=5,mode=620) tmpfs on /dev/shm type tmpfs (rw) /dev/sda1 on /boot type ext4 (rw) /dev/sdb1 on /var/www type ext3 (rw) /dev/sdd1 on /LUN93 type ext3 (rw) /dev/sdc on /LUN92 type ext3 (rw) /dev/sde1 on /LUN94 type ext3 (rw) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
Create a text file called data.txt, enter:
echo 'This is a test' > data.txt
Display the index number (inode) of data.txt, enter:
[root@unix-support-server LUN94]# ls -li data.txt
2113537 -rw-r--r-- 1 root root 15 Jun 9 18:19 data.txt
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# debugfs -w /dev/sde1
debugfs 1.41.12 (17-May-2010) debugfs: logdump -i <2113537> Inode 2113537 is at group 129, block 4227074, offset 0 Journal starts at block 25167, transaction 344454 FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2) (inode block for inode 2113537): Inode: 2113537 Type: regular Mode: 0644 Flags: 0x0 Generation: 1054075619 Version: 0x00000000 User: 0 Group: 0 Size: 15 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x575965d9 -- Thu Jun 9 18:19:29 2016 atime: 0x575965d9 -- Thu Jun 9 18:19:29 2016 mtime: 0x575965d9 -- Thu Jun 9 18:19:29 2016 Blocks: (0+1): 4247552 No magic number at block 31238: end of journal. debugfs: cat <2113537> This is a test debugfs: debugfs: q
[root@unix-support-server LUN94]# rm data.txt
rm: remove regular file `data.txt’? y
[root@unix-support-server LUN94]# cat data.txt
cat: data.txt: No such file or directory
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# dd if=/dev/sde1 of=data.txt bs=4096 count=1 skip=4247552
1+0 records in 1+0 records out 4096 bytes (4.1 kB) copied, 0.000536678 s, 7.6 MB/s
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# cat data.txt
This is a test
[root@unix-support-server LUN94]#