How to use debugfs to recover files

Create the optional directories to dump to. Enter debugfs: -c catastrophic mode — this mode tries its best to recover the files, without catastrophic mode even debugfs wont work. If debugfs -c didnt return any ls information we need to run through a loop. Remember that list of superblock numbers I had you get. Type the following to see that list again:. Let me recap this from the beginning not the whole beginning but just how I got biglist :. Also we will try a few different filesystem block size numbers, Im familiar with 4K filesystem blocks and 16K filesystem blocks, so those translated to bytes are and respectively- you can try your own if you want:.

So okay great you ran one of these commands what do you do then…. Well hopefully one of the commands returned a folder and file listing of some sort, then you can use it to your advantage to enter back into debugfs with that magical superblock number and block size number.

For example lets say I just ran the script above and it returned a whole bunch of nothing until I got to the line. Now that we know the winning block size is and superblock is As a sidenote you dont have to do specify both the superblock and blocksize, you can have it try to figure one or both out, the next 3 are perfectly legal commands:.

If all 4 work, thats fine, pick whichever, they all should have the same results. The final one is the original from Step 3. For example to recover the above system I would do the following. Of course you would have to wait forever in between each to start the next one, which bring me to the next subject — script this stuff so you dont have to wait.

You can just select all of those copy it and paste it right in, you will get the following data structure afterwards:. You can also combine the above commands into one pasteable line, instead of one pasteable chunk of commands:. The following 2 just do seperately:. Thats pretty much all of the important notes I have on debugfs, here is how to use the console portion of the debugfs the none script part of debugfs, running it without R as we did in step 3 :. STEP 4 Optional to watch the progress!!

To watch the progess, open another shell, or if your using screen open another screen, or if your using detach then detach or whatever:. Block size is usually , meaning bytes, or 4 Kilobytes.

Since this is alot to take in, and I have a long way of writing, let me throw this in, an example taken from the beginning — this is a script style example.

Scenario: Root filesystem failed, linux machine doesnt boot up. Pop in Knoppix to PC with problem, and start it up and open up a terminal shell. Run the following commands to identify what is your main curropt filesystem and how its labeled. Hopefully you can get the information of the Filesystem Size, this is optional its just so that when the backup is happening we know when its close to done:.

We get the following information :. Block count : Free blocks : Block size : GO TO www. Mount the destination — where we will dump the damages to — I will show you this example in the USB sense and Mounting Share sense. Undeletion means restoring files which have been deleted from Linux ext3 file system using rm command.

Deleted files can be recovered on ext3 file systems using the debugfs program. This quick tutorial describes how to recover a file that was recently deleted using nothing but standard Linux command line utilities. Only sys administrators and root user can view and recover the deleted files using debugfs command.

You need to immediately unmount the file system the deleted file was located on to minimizes the risk that the data of the deleted file are overwritten by other users or system process. A step-by-step guide for recovering files using debugfs. Create a text file called data. Please note down inode To find out the contents of the ext3 journal block of data using debugfs command. If anybody knows please help me.

Thanks in advance. Best Regards. Small Business - Try our new resources site! Post by Gilbert Raja dear paul, i tried that command, it gave the error "File system not open".

To recover the deleted files, u can use inode number of that files.