Howto: Recover a file when you don’t know inode number in Linux

Delete a file called abc.sh:
rm abc.sh
Type the following command:
# debugfs -w /dev/mapper/root
At debugfs: prompt type lsdel command:

debugfs: lsdel

Sample outputs:

 Inode  Owner  Mode    Size    Blocks   Time deleted
2113537      0 120777      3    1/   1 Tue May  1 06:21:22 2016
1 deleted inodes found.

Get block data, enter:

debugfs: logdump -i <2113537>

Sample outputs:

debugfs:  logdump -i <2113537>
Inode 2113537 is at group 129, block 4227074, offset 0
Journal starts at block 25167, transaction 344454
  FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2)
    (inode block for inode 2113537):
    Inode: 2113537   Type: regular        Mode:  0644   Flags: 0x0
    Generation: 1054075619    Version: 0x00000000
    User:     0   Group:     0   Size: 15
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    atime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    mtime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    Blocks:  (0+1): 4247552
No magic number at block 31238: end of journal.

Type the following command:
# dd if=/dev/mapper/root of=recovered.file.001 bs=4096 count=1 skip=4247552
# file recovered.file.001

Sample outputs:

file: ASCII text, with very long lines

View file, enter:
# more recovered.file.001

Leave a Reply

Your email address will not be published. Required fields are marked *

CAPTCHA *