Solved: debugfs: error undel: Filesystem opened read/only

Are you getting “filesystem read only” error while trying to undelete some inode/file.

debugfs:
undel: Filesystem opened read/only

debugfs:  undel 917831 
undel: Filesystem opened read/only
debugfs: 

It means the filesystem is opened read only and we can’t perform any actions on the inode.

To perform above undelete action, we need to open the filesystem in write mode.

1. Try to open the filesystem in write mode.

debugfs:  open /dev/sda1 -w
open: Filesystem /dev/sda1 is still open.  Close it first.

2. In case it is still open, close all open filesystems.
debugfs: close_filesys -a
debugfs:

3. Now re-open the filesystem in write mode using “-w” option.

debugfs:  open /dev/sda1 -w
debugfs:  

4. Now try to perform undel action.

debugfs:  undel 917831 /tmp/
917831: File not found by ext2_lookup 

Yes the command do worked, however our filesystem is not able to find the inode number 917831 and hence throws this error.

In case your filesystem is able to find the inode, it will recover the file in /tmp/.

I hope you liked the post.

Please feel free to post any of your suggestions/comments below.