Linux Ext2fs Undeletion mini-HOWTO: So, how do I undelete a file?

prev-8705353 next-6775821 toc-3994597

The procedure principally involves finding the data on the raw partition device and making it visible again to the operating system. There are basically two ways of doing this: one is to modify the existing filesystem such that the deleted inodes have their `deleted’ flag removed, and hope that the data just magically falls back into place. The other method, which is safer but slower, is to work out where the data lies in the partition and write it out into a new file.

There are some steps you need to take before beginning to attempt your data recovery; see sections Unmounting the filesystem, Preparing to change inodes directly and Preparing to write data elsewhere for details. To find out how to actually retrieve your files, see sections Finding the deleted inodes, Obtaining the details of the inodes, Recovering data blocks and Modifying inodes directly.

prev-8705353 next-6775821 toc-3994597

READ  Linux Advocacy mini-HOWTO: User Groups