Steps to Undelete a file using debugfs in Linux.

In this article, we will look at the steps how to undelete a file using debugfs command in Linux.

Suppose you have deleted some file on some partition and want to restore the file.

1. Identify the partition on which file is deleted.

[root@nglinux ~]# df -h /
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        20G  9.5G  9.2G  51% /
[root@nglinux ~]# 

2. Now run debugfs filesystem debugging utility in read-write mode.

[root@nglinux ~]# debugfs -w /dev/sda1
debugfs 1.41.12 (17-May-2010)
debugfs:  

3. Now list the recently deleted files’ inode.

debugfs:  lsdel
 Inode  Owner  Mode    Size      Blocks   Time deleted
0 deleted inodes found.
debugfs:  

4. Now undelete the respective inode.

debugfs:  undel < inode_number > 

After this, your file gets undeleted or restored.

Above is the process/steps which is followed in debugfs filesystem utility to restore the files.

However when i tried on my ext4 filesystem it hasn’t shown the deleted files’ inode.

I believe it should work with ext2 or ext3 filesystem.

Do post your suggestions/comments in case you succeed getting the deleted file inodes inside debugfs.

I hope you liked the article.