69 lines
2.4 KiB
HTML
69 lines
2.4 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
|
|
<HTML>
|
|
<HEAD>
|
|
<META NAME="GENERATOR" CONTENT="SGML-Tools 1.0.9">
|
|
<TITLE>Linux Ext2fs Undeletion mini-HOWTO: Finding the deleted inodes</TITLE>
|
|
<LINK HREF="Ext2fs-Undeletion-9.html" REL=next>
|
|
<LINK HREF="Ext2fs-Undeletion-7.html" REL=previous>
|
|
<LINK HREF="Ext2fs-Undeletion.html#toc8" REL=contents>
|
|
</HEAD>
|
|
<BODY>
|
|
<A HREF="Ext2fs-Undeletion-9.html">Next</A>
|
|
<A HREF="Ext2fs-Undeletion-7.html">Previous</A>
|
|
<A HREF="Ext2fs-Undeletion.html#toc8">Contents</A>
|
|
<HR>
|
|
<H2><A NAME="sec-finding"></A> <A NAME="s8">8. Finding the deleted inodes</A></H2>
|
|
|
|
<P>The next step is to ask the file system which inodes have recently been
|
|
freed. This is a task you can accomplish with <CODE>debugfs</CODE>. Start
|
|
<CODE>debugfs</CODE> with the name of the device on which the file system is stored:
|
|
<P>
|
|
<BLOCKQUOTE><CODE>
|
|
<PRE>
|
|
# debugfs /dev/hda5
|
|
</PRE>
|
|
</CODE></BLOCKQUOTE>
|
|
<P>If you want to modify the inodes directly, add a <CODE>-w</CODE> option to enable
|
|
writing to the file system:
|
|
<P>
|
|
<BLOCKQUOTE><CODE>
|
|
<PRE>
|
|
# debugfs -w /dev/hda5
|
|
</PRE>
|
|
</CODE></BLOCKQUOTE>
|
|
<P>The <CODE>debugfs</CODE> command to find the deleted inodes is <CODE>lsdel</CODE>. So, type
|
|
the command at the prompt:
|
|
<P>
|
|
<BLOCKQUOTE><CODE>
|
|
<PRE>
|
|
debugfs: lsdel
|
|
</PRE>
|
|
</CODE></BLOCKQUOTE>
|
|
<P>After much wailing and grinding of disk mechanisms, a long list is piped into
|
|
your favourite pager (the value of <CODE>$PAGER</CODE>). Now you'll want to
|
|
save a copy of this somewhere else. If you have <CODE>less</CODE>, you can type
|
|
<CODE>-o</CODE> followed by the name of an output file. Otherwise, you'll have to
|
|
arrange to send the output elsewhere. Try this:
|
|
<P>
|
|
<BLOCKQUOTE><CODE>
|
|
<PRE>
|
|
debugfs: quit
|
|
# echo lsdel | debugfs /dev/hda5 > lsdel.out
|
|
</PRE>
|
|
</CODE></BLOCKQUOTE>
|
|
<P>Now, based only on the deletion time, the size, the type, and the numerical
|
|
permissions and owner, you must work out which of these deleted inodes are the
|
|
ones you want. With luck, you'll be able to spot them because they're the big
|
|
bunch you deleted about five minutes ago. Otherwise, trawl through that list
|
|
carefully.
|
|
<P>I suggest that if possible, you print out the list of the inodes you want to
|
|
recover. It will make life a lot easier.
|
|
<P>
|
|
<P>
|
|
<HR>
|
|
<A HREF="Ext2fs-Undeletion-9.html">Next</A>
|
|
<A HREF="Ext2fs-Undeletion-7.html">Previous</A>
|
|
<A HREF="Ext2fs-Undeletion.html#toc8">Contents</A>
|
|
</BODY>
|
|
</HTML>
|