Posts

Showing posts from May, 2015

Linux - Using debugfs to Recover Deleted File

debugfs is a very useful tool to debug ext2/ext3/ext4 file system. If your file is deleted, it could be possible to recover it via debugfs if the file's file descriptor is still be opened by some process.

Disclaimer: debugfs is some low level process that could be used to examine and modify the underlying file system. That also means, any mistake may trash your file system.

Prerequisite

1. Check whether the file descriptor is still being opened by some process

cat /proc/locks | grep {pid}  -- this will list the locks holds by {pid}

ls -al /proc/{pid}/fd/  -- this will list the file descriptor currently opened by {pid}

Note: You could use ps -ef to display the pid of the desired process.

2. Identify the inode number of the delete file.

The easiest way to know the inode number of a file is

ls -i

Example ls -i

$ ls -i example.txt
6710909 example.txt

The inode number for example.txt is 671909
Another way is to use lsof
Example of lsof
$ ps -ef | grep vi
root     24216 22841  0 10:41 …