Linux tip, Fedora tip / howto: undeleting files (on ext2 filesystems)

Note that these tips are mostly outdated

back to notes and tips index

Try my online puzzle page with Calcudoku, Killer Sudoku and online Sudoku.

undeleting files (on ext2 filesystems)

  • stop in your tracks, do as little as possible with your files
  • let's assume you deleted some files from /home/myaccount/source
  • find out which partition the deleted file is on. For example, run df, and see that /home is a directory under /, which lives on /dev/hda5 (all examples, your case may be different)
  • su to root
  • for safety, umount /dev/hda5 (this may not be possible though)
  • change to a directory on a different partition (/boot for example), and create a temp directory there
  • run debugfs /dev/hda5
  • at the prompt, run lsdel. It will list inode, owner, mode, size, blocks & time of all deleted files on that partition. This list could be long. Near the bottom are your recently deleted files. You'll recognize them by the id (run id to find out your account's id number), filesize, deletion time. Note the inodes of the files you want to recover.
  • run dump <inode> /boot/temp/filename for each file you want to recover. Note: you need the angled brackets around the inode number!
A program which has a more sophisticated interface for doing this is e2undel (still have to try it out).

← back to notes and tips index
Please do not copy the text of this tip (© Patrick Min) to your web site.