CODEWITHSUNDEEP
ext4
Benny
Benny

Reputation: 179

ext4: how to recover allocated inode

I have a special problem with an ext4-filesystem on Ubuntu 16.04. I wanted to move some directories to a different location using the filemanager "nautilus". For an unknown reason the transaction crashed. No the source-folder is empty as the target folder is too.

I almost immediatly shutdown the PC and removed the HDD to a docking-station of a different system. I used tool "extundelete" to recover the lost data. Unfortunatly this did not work.

To me it looks like the whole files are there, but the inode holding the data is not "deleted" it is "allocated", so extundelete could not recover the "not deleted"-files.

Here is my command and the output:

extundelete --inode 4730457 /dev/sdh1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 1877 groups loaded.
Group: 577
Contents of inode 4730457:
0000 | fd 41 e8 03 00 10 00 00 33 4f bf 5a 64 4f bf 5a | .A......3O.ZdO.Z
0010 | a4 39 bf 5a 00 00 00 00 e8 03 3b 00 08 00 00 00 | .9.Z......;.....
0020 | 00 00 08 00 3a 00 00 00 0a f3 01 00 04 00 00 00 | ....:...........
0030 | 00 00 00 00 00 00 00 00 01 00 00 00 bc 26 20 01 | .............& .
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 d5 24 79 29 00 00 00 00 00 00 00 00 | .....$y)........
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0080 | 20 00 00 00 7c c9 b5 58 f0 2b 9b 4d 98 2b 49 52 |  ...|..X.+.M.+IR
0090 | 15 3e 5e 59 b4 77 ac d3 00 00 00 00 00 00 00 00 | .>^Y.w..........
00a0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00c0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00d0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
00f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is Allocated
File mode: 16893
Low 16 bits of Owner Uid: 1000
Size in bytes: 4096
Access time: 1522487091
Creation time: 1522487140
Modification time: 1522481572
Deletion Time: 0
Low 16 bits of Group Id: 1000
Links count: 59
Blocks count: 8
File flags: 524288
File version (for NFS): 695805141
File ACL: 0
Directory ACL: 0
Fragment address: 0
Direct blocks: 127754, 4, 0, 0, 1, 18884284, 0, 0, 0, 0, 0, 0
Indirect block: 0
Double indirect block: 0
Triple indirect block: 0

File name                                       | Inode number | Deleted status
.                                                 4730457
..                                                5376234
<HERE FOLLOWES A LIST OF THE DIRECTORIES, NONE HAS A "DELETED STATUS">

Is there a way, a tutorial or any hint how I can copy/recover/repair this?

Many thanks in advance

Never found a working solution for this. I was able to "recover" files using the tool photorec, which comes with testdisk on my Linux Mint.

This tool is easy to use and it was able to find all files. BUT all files are corrupted and intermixed, so I guess they are lost anyway - back to square one...

Upvotes: 0

Views: 1407

Answers (1)

H. Jang
H. Jang

Reputation: 348

How about checking that file really has gone away? By using below command.

find . -inum 4730457

or

find . -inum <inum>

If you can find that file using this command, the file still exists.

Upvotes: 1

Related Questions