In this article, we will look at the steps how to undelete a file using debugfs command in Linux.
Suppose you have deleted some file on some partition and want to restore the file.
1. Identify the partition on which file is deleted.
[root@nglinux ~]# df -h / Filesystem Size Used Avail Use% Mounted on /dev/sda1 20G 9.5G 9.2G 51% / [root@nglinux ~]#
2. Now run debugfs filesystem debugging utility in read-write mode.
[root@nglinux ~]# debugfs -w /dev/sda1 debugfs 1.41.12 (17-May-2010) debugfs:
3. Now list the recently deleted files’ inode.
debugfs: lsdel Inode Owner Mode Size Blocks Time deleted 0 deleted inodes found. debugfs:
4. Now undelete the respective inode.
debugfs: undel < inode_number >
After this, your file gets undeleted or restored.
Above is the process/steps which is followed in debugfs filesystem utility to restore the files.
However when i tried on my ext4 filesystem it hasn’t shown the deleted files’ inode.
I believe it should work with ext2 or ext3 filesystem.
Do post your suggestions/comments in case you succeed getting the deleted file inodes inside debugfs.
I hope you liked the article.