Extundelete

This forum is dedicated to advanced help and support :

Ask here your questions about advanced usage of Mageia. For example you may post here all your questions about network and automated installs, complex server configurations, kernel tuning, creating your own Mageia mirrors, and all tasks likely to be touchy even for skilled users.

Extundelete

Postby adhefe » Jan 25th, '21, 03:05

I suppose I need advanced support ...
I finally did it: I've removed all my home area content and I wonder if I can yet get it back.

I've tried extundelete as follows:

Code: Select all
# extundelete /dev/sda1 --restore-directory home/my_user/
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 7453 groups loaded.
Loading journal descriptors   ...  0 descriptors loaded.
extundelete: Extent block checksum does not match extent block while finding inode for home
extundelete: Extent block checksum does not match extent block while finding inode for home
Failed to restore file home/my_user/
Could not find correct inode number past inode 2.
Try altering the file name to one of the entries listed below.
File name                                        |  inode number  |  Deleted status
extundelete: Operation not permitted while restoring directory.
extundelete: Operation not permitted when trying to examine filesystem


Don't know why there are no "0 descriptors found", Don't know why checksum doesn't match. Don't even know what information above is relevant.
Where and what journal descriptors are recorded?

Thanks for any tip
adhefe
 
Posts: 188
Joined: Mar 11th, '19, 02:08

Re: Extundelete

Postby doktor5000 » Jan 25th, '21, 18:05

You may want to read the extundelete documentation again. And provide some more context information on how you deleted that.
Also if /home was a separate partition then you would need to leave out the mountpoint as part of the folder/filename part e.g. if you want to restore what was /home/adhefe and was located on /home partition then adhefe is the folder/file that you want to restore.
You could also try with --restore-all to simply restore everything to a different folder.

Output of lsblk would also be helpful. As it's not visible from your description what /dev/sda1 is, usually this should be your root partition, but you want to restore /home which by default is a separate partition, as mentioned above ...
Cauldron is not for the faint of heart!
Caution: Hot, bubbling magic inside. May explode or cook your kittens!
----
Disclaimer: Beware of allergic reactions in answer to unconstructive complaint-type posts
User avatar
doktor5000
 
Posts: 17630
Joined: Jun 4th, '11, 10:10
Location: Leipzig, Germany

Re: Extundelete

Postby adhefe » Jan 25th, '21, 18:52

First, thanks a lot for the answer!
1 - How I deleted it: in an attempt to remove a file that was created by gvim with a weird name (something like <S-F1> or so) I did rm ~/<*, the system returned that it could not remove a directory and I thought <S-F1> was a directory and then I did rm -rf ~/<* and everything was gone. In my limited knowledge, I thought "<" was a regular character ...
2 - /home is in a separate partitition on a SSHD, a HD with a SSD for cache. Here it is really in /dev/sda1. The root / directory is in /dev/sdb1 in a regular SSD device.
3 - I have already tried restore-all with different combinations like home/my_user, only home and with /home too with mostly the same output.

Now, rereading extundelete's manual...
adhefe
 
Posts: 188
Joined: Mar 11th, '19, 02:08

Re: Extundelete

Postby adhefe » Jan 26th, '21, 15:09

Tried photorec. It successfuly recovered many files but their original names and directory are unknown. Does testdisk perform better in files identification? What are the differences between photorec and testdisk? Thanks for any help.
adhefe
 
Posts: 188
Joined: Mar 11th, '19, 02:08

Re: Extundelete

Postby doktor5000 » Jan 26th, '21, 18:28

testdisk is used when recovering deleted/formatted partitions, photorec is meant for deleted files and only searches based on a signature inside those files, it does not know the filename.
You could also try with testdisk, see https://www.cgsecurity.org/wiki/TestDis ... e_for_ext2
Cauldron is not for the faint of heart!
Caution: Hot, bubbling magic inside. May explode or cook your kittens!
----
Disclaimer: Beware of allergic reactions in answer to unconstructive complaint-type posts
User avatar
doktor5000
 
Posts: 17630
Joined: Jun 4th, '11, 10:10
Location: Leipzig, Germany

Re: Extundelete

Postby adhefe » Jan 26th, '21, 19:36

Hi doktor5000, thanks but this reference seems not to work for ext4 as it can be read from testdisk manual:

8.1 TestDisk: undelete file for FAT, exFAT, ext2

FAT is mainly used on memory cards from digital cameras and on USB keys. When a file is deleted, the filenameis marked as deleted and the data area as unallocated/free, but TestDisk can read the deleted directory entry and findwhere the file began. If the data area hasn’t been overwritten by a new file, the file is recoverable.

exFAT can be found on large memory card, large USB keys and hard disk.

ext2 is a Linux filesystem. It has been superseded by ext3 and ext4, so it’s not found often now. With ext3 and ext4,it’s possible to find the names of the deleted files but the location of the deleted data isn’t available anymore, so evenif ext3/ext4 is similar to ext2, it’s not possible to recover lost files using TestDisk.
adhefe
 
Posts: 188
Joined: Mar 11th, '19, 02:08


Return to Advanced support

Who is online

Users browsing this forum: No registered users and 1 guest