Howto: Recover a file when you don’t know inode number in Linux

Delete a file called abc.sh:
rm abc.sh
Type the following command:
# debugfs -w /dev/mapper/root
At debugfs: prompt type lsdel command:

debugfs: lsdel

Sample outputs:

 Inode  Owner  Mode    Size    Blocks   Time deleted
2113537      0 120777      3    1/   1 Tue May  1 06:21:22 2016
1 deleted inodes found.

Get block data, enter:

debugfs: logdump -i <2113537>

Sample outputs:

debugfs:  logdump -i <2113537>
Inode 2113537 is at group 129, block 4227074, offset 0
Journal starts at block 25167, transaction 344454
  FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2)
    (inode block for inode 2113537):
    Inode: 2113537   Type: regular        Mode:  0644   Flags: 0x0
    Generation: 1054075619    Version: 0x00000000
    User:     0   Group:     0   Size: 15
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    atime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    mtime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    Blocks:  (0+1): 4247552
No magic number at block 31238: end of journal.

Type the following command:
# dd if=/dev/mapper/root of=recovered.file.001 bs=4096 count=1 skip=4247552
# file recovered.file.001

Sample outputs:

file: ASCII text, with very long lines

View file, enter:
# more recovered.file.001

2 thoughts on “Howto: Recover a file when you don’t know inode number in Linux”

  1. Prasad K. Jadhav

    I tried on 2 linux machine with different file system
    on xfs output as under:
    [root@localhost ~]# debugfs -w /dev/mapper/centos-root
    debugfs 1.42.9 (28-Dec-2013)
    /dev/mapper/centos-root: Bad magic number in super-block while opening filesystem
    debugfs: lsdel
    lsdel: Filesystem not open

    on ext4 output as under:
    [root@localhost ~]# debugfs -w /dev/mapper/VolGroup-lv_root
    debugfs 1.41.12 (17-May-2010)
    debugfs: lsdel
    Inode Owner Mode Size Blocks Time deleted
    0 deleted inodes found.
    debugfs: quit

Leave a Comment

Your email address will not be published. Required fields are marked *

CAPTCHA * Time limit is exhausted. Please reload the CAPTCHA.

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Scroll to Top