Monday, May 18, 2015

Linux - Using debugfs to Recover Deleted File

debugfs is a very useful tool to debug ext2/ext3/ext4 file system. If your file is deleted, it could be possible to recover it via debugfs if the file's file descriptor is still be opened by some process.

Disclaimer: debugfs is some low level process that could be used to examine and modify the underlying file system. That also means, any mistake may trash your file system.


1. Check whether the file descriptor is still being opened by some process

cat /proc/locks | grep {pid}  -- this will list the locks holds by {pid}

ls -al /proc/{pid}/fd/  -- this will list the file descriptor currently opened by {pid}

Note: You could use ps -ef to display the pid of the desired process.

2. Identify the inode number of the delete file.

The easiest way to know the inode number of a file is

ls -i

Example ls -i

$ ls -i example.txt
6710909 example.txt

The inode number for example.txt is 671909

Another way is to use lsof

Example of lsof

$ ps -ef | grep vi
root     24216 22841  0 10:41 pts/2    00:00:00 vi example.txt

$ lsof -p 24216 
vi      24518 root    4u   REG    8,2    12288 6710944 /tmp/.example.txt.swp

The inode number for /tmp/.example.txt.swp is 6710944

3. Identify the filesystem where the inode is from. 

The easiest way is to use the following command

df -h /your/path


$ df -h /tmp
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda2              57G   20G   34G  37% /

My /tmp is located at /dev/sda2

Using of debugfs to recover the file from inode

1) To use debugfs, you need to first open the file system

debugfs {your_filesystem}


$ debugfs /dev/sda2
debugfs 1.39 (29-May-2006)

2) Use cat command to view the content of the inode

cat < inode_number >

debugfs:  cat <6710909>
hello world

3. Use dump_inode to dump the inode content to a file

dump_inode  < inode_number > /path/to/file


debugfs:  dump_inode <6710909> /tmp/inode_example.txt

4. Check the content of the inode dump. 

You can use ls and cat command to do this.


$ ls -ali *example*
6710909 -rw-r--r-- 1 root root 18 Dec 16 10:54 example.txt
6710944 -rw-r--r-- 1 root root 18 Dec 16 11:07 inode_example.txt

$ cat inode_example.txt
hello world
$ cat example.txt
hello world

As you can see, both files have the identical content. However, you should note that these 2 files have 2 different inode number.

I am still finding a way to restore the dump inode file to the orginal inode number. That is, restore inode_example.txt back to inode number 6710909. If you have some idea, please feel free to tell me.

No comments:

Post a Comment

Facebook - Control privacy setting of liked page

By default, Facebook displayed your liked page to public. It is the user responsibility to adjust the privacy setting. And in my opinion, F...