How to recover a deleted file in Linux ?

A step-by-step guide for recovering files using debugfs

[root@unix-support-server ~]# mount

/dev/sda2 on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/sda1 on /boot type ext4 (rw)
/dev/sdb1 on /var/www type ext3 (rw)
/dev/sdd1 on /LUN93 type ext3 (rw)
/dev/sdc on /LUN92 type ext3 (rw)
/dev/sde1 on /LUN94 type ext3 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

Create a text file called data.txt, enter:
echo 'This is a test' > data.txt
Display the index number (inode) of data.txt, enter:
[root@unix-support-server LUN94]# ls -li data.txt

2113537 -rw-r--r-- 1 root root 15 Jun  9 18:19 data.txt

[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# debugfs -w /dev/sde1

debugfs 1.41.12 (17-May-2010)
debugfs:  logdump -i  <2113537>
Inode 2113537 is at group 129, block 4227074, offset 0
Journal starts at block 25167, transaction 344454
  FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2)
    (inode block for inode 2113537):
    Inode: 2113537   Type: regular        Mode:  0644   Flags: 0x0
    Generation: 1054075619    Version: 0x00000000
    User:     0   Group:     0   Size: 15
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    atime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    mtime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    Blocks:  (0+1): 4247552
No magic number at block 31238: end of journal.

debugfs:  cat  <2113537>
This is a test
debugfs:  q

[root@unix-support-server LUN94]# rm data.txt
rm: remove regular file `data.txt’? y
[root@unix-support-server LUN94]# cat data.txt
cat: data.txt: No such file or directory
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# dd if=/dev/sde1 of=data.txt bs=4096 count=1 skip=4247552

1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.000536678 s, 7.6 MB/s

[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# cat data.txt

This is a test

[root@unix-support-server LUN94]#

Leave a Reply

Your email address will not be published. Required fields are marked *