Videos
So.... yesterday I did something really dumb. I accidentally deleted a partition and I want to see if anyone has recommendations for Linux tools.
It was done in Windows, the drive was an external drive formatted as ExFat. I realized immediately that I had selected the wrong drive, so very little data (if any) was overwritten, it just got formatted to NTFS and I quickly killed the program. It's not a total loss, because all the important stuff is backed up elsewhere, but it's still super annoying because I was in the process of organizing a decade's worth of photos into folders and I'd like to just recover the partition if possible. Spent DAYS so far.
Already tried MiniTool Partition Wizard, no luck there. It finds a million files, but not the partition. I'm currently trying testdisk on Linux, but wanted to ask if anyone has other suggestions, or has any tips.
Thanks for any help!!
Currently on Kubuntu 22.04, if that makes a difference.
The link someone provided in the comments is likely your best chance.
Linux debugfs Hack: Undelete Files
That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows:
Use debugfs to view a filesystems log
$ debugfs -w /dev/mapper/wks01-rootAt the debugfs prompt
debugfs: lsdelSample output
Inode Owner Mode Size Blocks Time deleted 23601299 0 120777 3 1/ 1 Tue Mar 13 16:17:30 2012 7536655 0 120777 3 1/ 1 Tue May 1 06:21:22 2012 2 deleted inodes found.Run the command in debugfs
debugfs: logdump -i <7536655>Determine files inode
... ... .... output truncated Fast_link_dest: bin Blocks: (0+1): 7235938 FS block 7536642 logged at sequence 38402086, journal block 26711 (inode block for inode 7536655): Inode: 7536655 Type: symlink Mode: 0777 Flags: 0x0 Generation: 3532221116 User: 0 Group: 0 Size: 3 File ACL: 0 Directory ACL: 0 Links: 0 Blockcount: 0 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x4f9fc732 -- Tue May 1 06:21:22 2012 atime: 0x4f9fc730 -- Tue May 1 06:21:20 2012 mtime: 0x4f9fc72f -- Tue May 1 06:21:19 2012 dtime: 0x4f9fc732 -- Tue May 1 06:21:22 2012 Fast_link_dest: bin Blocks: (0+1): 7235938 No magic number at block 28053: end of journal.With the above inode info run the following commands
# dd if=/dev/mapper/wks01-root of=recovered.file.001 bs=4096 count=1 skip=7235938 # file recovered.file.001 file: ASCII text, with very long lines
Files been recovered to recovered.file.001.
Other options
If the above isn't for you I've used tools such as photorec to recover files in the past, but it's geared for image files only. I've written about this method extensively on my blog in this article titled:
How to Recover Corrupt jpeg and mov Files from a Digital Camera's SDD Card on Fedora/CentOS/RHEL.
If you know a very specific pattern in your deleted files, use grep to search in the hard-drive (maybe browse your clipboard to search a pasted line, or vim yank):
grep -a -C 300 -F 'known fixed string in deleted file' /dev/sda > ~/recover
Better change ~/recover for a path to another drive if your HOME is on the same drive you search.
then edit ~/recover to keep only what was your file before by editing. With by example vim editor, that will be a simple task.
Hey, if with Unix philosophy all is files, it's time to take advantage of this, no ?
Explanations
-ais meant to grep even binary data-C<NUM>specifies lines of output context from before and after each match of the string; you can use-B<NUM>to include lines before each match or-A<NUM>to include lines after each match instead-Ffixed string
Another approach, using potential remaining File Descriptor
With a bit of chances, sometimes I can recover deleted files with this :
#!/bin/bash
export LANG=C
if [[ ! $1 || $1 == -h || $1 == --help ]]; then
echo -e "Usage:\n\n\t$0 '[path/]<file name>'"
exit 1
fi
files=(
$(file 2>/dev/null /proc/*/fd/* |
grep "(deleted)'$" |
sed -r 's@(:.*broken\s+symbolic\s+link\s+to\s+.|\(deleted\).$)@ @g' |
grep "$1" |
cut -d' ' -f1
)
)
if [[ ${files[@]} ]]; then
for f in ${files[@]}; do
echo "fd $f match... Try to copy this fd to another place quickly!"
done
else
echo >&2 "No matching fd found..."
exit 2
fi