Tag Archives: recover

Howto: Recover a file when you don’t know inode number in Linux

Delete a file called abc.sh:
rm abc.sh
Type the following command:
# debugfs -w /dev/mapper/root
At debugfs: prompt type lsdel command:

debugfs: lsdel

Sample outputs:

 Inode  Owner  Mode    Size    Blocks   Time deleted
2113537      0 120777      3    1/   1 Tue May  1 06:21:22 2016
1 deleted inodes found.

Get block data, enter:

debugfs: logdump -i <2113537>

Sample outputs:

debugfs:  logdump -i <2113537>
Inode 2113537 is at group 129, block 4227074, offset 0
Journal starts at block 25167, transaction 344454
  FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2)
    (inode block for inode 2113537):
    Inode: 2113537   Type: regular        Mode:  0644   Flags: 0x0
    Generation: 1054075619    Version: 0x00000000
    User:     0   Group:     0   Size: 15
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    atime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    mtime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    Blocks:  (0+1): 4247552
No magic number at block 31238: end of journal.

Type the following command:
# dd if=/dev/mapper/root of=recovered.file.001 bs=4096 count=1 skip=4247552
# file recovered.file.001

Sample outputs:

file: ASCII text, with very long lines

View file, enter:
# more recovered.file.001

How to recover a deleted file in Linux ?

A step-by-step guide for recovering files using debugfs

[root@unix-support-server ~]# mount

/dev/sda2 on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/sda1 on /boot type ext4 (rw)
/dev/sdb1 on /var/www type ext3 (rw)
/dev/sdd1 on /LUN93 type ext3 (rw)
/dev/sdc on /LUN92 type ext3 (rw)
/dev/sde1 on /LUN94 type ext3 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)

Create a text file called data.txt, enter:
echo 'This is a test' > data.txt
Display the index number (inode) of data.txt, enter:
[root@unix-support-server LUN94]# ls -li data.txt

2113537 -rw-r--r-- 1 root root 15 Jun  9 18:19 data.txt

[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# debugfs -w /dev/sde1

debugfs 1.41.12 (17-May-2010)
debugfs:  logdump -i  <2113537>
Inode 2113537 is at group 129, block 4227074, offset 0
Journal starts at block 25167, transaction 344454
  FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2)
    (inode block for inode 2113537):
    Inode: 2113537   Type: regular        Mode:  0644   Flags: 0x0
    Generation: 1054075619    Version: 0x00000000
    User:     0   Group:     0   Size: 15
    File ACL: 0    Directory ACL: 0
    Links: 1   Blockcount: 8
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    atime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    mtime: 0x575965d9 -- Thu Jun  9 18:19:29 2016
    Blocks:  (0+1): 4247552
No magic number at block 31238: end of journal.

debugfs:  cat  <2113537>
This is a test
debugfs:
debugfs:  q

[root@unix-support-server LUN94]# rm data.txt
rm: remove regular file `data.txt’? y
[root@unix-support-server LUN94]# cat data.txt
cat: data.txt: No such file or directory
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# dd if=/dev/sde1 of=data.txt bs=4096 count=1 skip=4247552

1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.000536678 s, 7.6 MB/s

[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# cat data.txt

This is a test

[root@unix-support-server LUN94]#

How to recover a deleted file in aix / jfs?

It is possible to recover the file using the “fsdb” command (filesystem debugger). when,

No new files have been created on the filesystem.

No files have been extended.

The filesystem is able to be unmounted.

Warning: I have test this in my test server. This is undocumented one. You may facing the critical problem when you follow the below steps on your systems. So try this at your own risk. Please avoid directly try this with your production servers. Here is the output for your reference.

You can get deleted files inode if you don’t have.

#fuser -dV

inode=68     size=34358697984  fd=6
inode=76     size=16106135552  fd=7
inode=65     size=34358697984  fd=16
inode=68     size=34358697984  fd=11
inode=68     size=34358697984  fd=7
inode=68     size=34358697984  fd=6

# lsvg -l testvg

testvg:

LV NAME             TYPE       LPs   PPs   PVs  LV STATE      MOUNT POINT

loglv00             jfs2log    1     1     1    closed/syncd  N/A

#

# crfs -a size=256M -v jfs2 -g testvg -m /new            à create a “/new” FS

File system created successfully.

261932 kilobytes total disk space.

New File System size is 524288

#

# lsvg -l testvg

testvg:

LV NAME             TYPE       LPs   PPs   PVs  LV STATE      MOUNT POINT

loglv00             jfs2log    1     1     1    closed/syncd  N/A

fslv00              jfs2       16    16    1    closed/syncd  /new

#

# mount /new         à mount the /new FS

#

# lsvg -l testvg

testvg:

LV NAME             TYPE       LPs   PPs   PVs  LV STATE      MOUNT POINT

loglv00             jfs2log    1     1     1    open/syncd    N/A

fslv00              jfs2       16    16    1    open/syncd    /new

#

# cd /new

#

# ls -l

total 0

drwxr-xr-x   2 root     system          256 Apr 03 16:47 lost+found

#

# cat >> film         à Create a file named “film”

Hi this is the test file. I want to use this file for recovery test

^C#

#

# cat film

Hi this is the test file. I want to use this file for recovery test

#

# ls –il        à check the inode number of the file “film”. That is 4

total 8

4 -rw-r–r–   1 root     system           68 Apr 03 16:49 film

3 drwxr-xr-x   2 root     system          256 Apr 03 16:47 lost+found

#

#

# rm film     à remove the file “film”

#

# ls -l

total 0

drwxr-xr-x   2 root     system          256 Apr 03 16:47 lost+found

#

# cd ~

#

# umount /new     à unmount the /new FS

#

# lsvg -l testvg

testvg:

LV NAME             TYPE       LPs   PPs   PVs  LV STATE      MOUNT POINT

loglv00             jfs2log    1     1     1    closed/syncd  N/A

fslv00              jfs2       16    16    1    closed/syncd  /new

#

# fsdb /dev/fslv00       à use the “fsdb <lv_name>” to recover the deleted  file.

File System:                    /dev/fslv00

File System Size:               523864  (512 byte blocks)

Aggregate Block Size:           4096

Allocation Group Size:          8192    (aggregate blocks)

> dir 2

idotdot = 2

3      lost+found

>

> i 4     à provide the inode number of our deleted file. That is 4

Inode 4 at block 33, offset 0x800:

[1] di_fileset:         16                 [18] di_inostamp:       0x4d98ead4

[2] di_number:          4               [19] di_gen:            3940655789

[3] di_size:    0x0000000000000044      [20] di_ixpxd.len:      4

[4] di_nblocks: 0x0000000000000001      [21] di_ixpxd.addr1:    0x00

[5] di_nlink:           0               [22] di_ixpxd.addr2:    0x00000021

[6] di_mode:            0x000081a4           di_ixpxd.address:  33

0100644 -rw-r–r–      [24] di_uid:            0

[25] di_gid:            0

[9] di_atime.tj_nsec:   0x1e8a1025      [26] di_atime.tj_sec:0x000000004d98eb7d

[10] di_ctime.tj_nsec:  0x0ca85614      [27] di_ctime.tj_sec:0x000000004d98ebac

[11] di_mtime.tj_nsec:  0x1af63892      [28] di_mtime.tj_sec:0x000000004d98eb77

[12] di_otime.tj_nsec:  0x03b74a9a      [29] di_otime.tj_sec:0x000000004d98eb24

[13] di_ea.flag:        0x00            [30] di_ea.len:         0

EAv1                               [31] di_ea.addr1:       0x00

[15] di_ea.nEntry:      0x00            [32] di_ea.addr2:       0x00000000

[16] di_ea.type:        0x0000               di_ea.address:     0

[34] di_ea.nblocks:     0

change_inode: [m]odify, [e]a, [t]ree, or e[x]it > m     à choose “m” to modify

Please enter: field-number value > 5  1   à  put the field number is 5, change the di_nlink value to 1

Inode 4 at block 33, offset 0x800:

[1] di_fileset:         16              [18] di_inostamp:       0x4d98ead4

[2] di_number:          4               [19] di_gen:            3940655789

[3] di_size:    0x0000000000000044      [20] di_ixpxd.len:      4

[4] di_nblocks: 0x0000000000000001      [21] di_ixpxd.addr1:    0x00

[5] di_nlink:           1               [22] di_ixpxd.addr2:    0x00000021

[6] di_mode:            0x000081a4           di_ixpxd.address:  33

0100644 -rw-r–r–      [24] di_uid:            0

[25] di_gid:            0

[9] di_atime.tj_nsec:   0x1e8a1025      [26] di_atime.tj_sec:0x000000004d98eb7d

[10] di_ctime.tj_nsec:  0x0ca85614      [27] di_ctime.tj_sec:0x000000004d98ebac

[11] di_mtime.tj_nsec:  0x1af63892      [28] di_mtime.tj_sec:0x000000004d98eb77

[12] di_otime.tj_nsec:  0x03b74a9a      [29] di_otime.tj_sec:0x000000004d98eb24

[13] di_ea.flag:        0x00            [30] di_ea.len:         0

EAv1                               [31] di_ea.addr1:       0x00

[15] di_ea.nEntry:      0x00            [32] di_ea.addr2:       0x00000000

[16] di_ea.type:        0x0000               di_ea.address:     0

[34] di_ea.nblocks:     0

change_inode: [m]odify, [e]a, [t]ree, or e[x]it > x    à exit

> quit

#

# fsck -yp /dev/fslv00     à run fsck to repaired the  inconsistencies.

The current volume is: /dev/fslv00

Primary superblock is valid.

J2_LOGREDO:log redo processing for /dev/fslv00

logredo start at: 1301867616 sec and end at 1301867616 sec

Primary superblock is valid.

*** Phase 1 – Initial inode scan

*** Phase 2 – Process remaining directories

*** Phase 3 – Process remaining files

*** Phase 4 – Check and repair inode allocation map

File system inode map is corrupt (FIXED)

Superblock marked dirty because repairs are about to be written.

*** Phase 5 – Check and repair block allocation map

Block allocation map is corrupt (FIXED)

Inodes not connected to the root directory

tree have been detected.  Will reconnect.

File system is clean.

Superblock is marked dirty (FIXED)

All observed inconsistencies have been repaired.

#

# mount /new   à mount the /new FS

# lsvg -l testvg

testvg:

LV NAME             TYPE       LPs   PPs   PVs  LV STATE      MOUNT POINT

loglv00             jfs2log    1     1     1    open/syncd    N/A

fslv00              jfs2       16    16    1    open/syncd    /new

#

# cd /new  à goto the /new FS

#

# ls -l

total 0

drwxr-xr-x   2 root     system          256 Apr 03 16:47 lost+found

#

# cd lost+found   à go to lost+found dir

#

# pwd

/new/lost+found

#

# ls -l

total 8

-rw-r–r–   1 root     system           68 Apr 03 16:49 4     à you can see the deleted file in the name of your inode number

#

# cat 4   à confirm the file content

Hi this is the test file. I want to use this file for recovery test

#

# mv 4 /new/.      à move the file to the exact place where it was before

#

# pwd

/new/lost+found

# cd ..

#

# pwd

/new

# ls -l

total 8

-rw-r–r–   1 root     system           68 Apr 03 16:49 4

drwxr-xr-x   2 root     system          256 Apr 03 16:55 lost+found

#

# cat 4

Hi this is the test file. I want to use this file for recovery test

#

# mv 4 film  à change the name of the recovered file to the old one.

#

# ls -l

total 8

-rw-r–r–   1 root     system           68 Apr 03 16:49 film   à the deleted file has been recovered.

drwxr-xr-x   2 root     system          256 Apr 03 16:55 lost+found

#

#