This mini-Howto attempts to provide hints on how to retrieve deleted files from an ext2 filesystem. It also contains a limited amount of discussion of how to avoid deleting files in the first place.
I intend it to be useful certainly for people who have just had, shall we say,
a little accident with rm; however, I also hope that people read it
anyway. You never know: one day, some of the information in here could save
your bacon.
The text assumes a little background knowledge about UNIX filesystems in general; however, I hope that it will be accessible to most Linux users. If you are an outright beginner, I'm afraid that undeleting files under Linux does require a certain amount of technical knowledge and persistence, at least for the time being.
You will be unable to recover deleted files from an ext2 filesystem without at
least read access to the raw device on which the file was stored. In general,
this means that you must be root. You also need debugfs from the
e2fsprogs package. This should have been installed by your distribution.
Why have I written this? It stems largely from my own experiences with a
particularly foolish and disastrous rm -r command as root. I deleted
about 97 JPEG files which I needed and could almost certainly not recover from
other sources. Using some helpful tips (see section
Credits and Bibliography) and a great deal of
persistence, I recovered 91 files undamaged. I managed to retrieve at least
parts of five of the rest (enough to see what the picture was in each case).
Only one was undisplayable, and even for this one, I am fairly sure that no
more than 1024 bytes were lost (though unfortunately from the beginning of the
file; given that I know nothing about the JFIF file format I had done as much
as I could).
I shall discuss further below what sort of recovery rate you can expect for deleted files.
The various publicly-released revisions of this document (and their publication dates) are as follows:
What changes have been made in this version? First of all, the thinko in the example of file recovery has been fixed. Thankyou to all those who wrote to point out my mistaek; I hope I've learned to be more careful when making up program interaction.
Secondly, the discussion of UNIX filesystem layout has been rewritten to be, I hope, more understandable. I wasn't entirely happy with it in the first place, and some people's comments indicated that it wasn't clear.
Thirdly, the vast uuencoded gzipped tarball of fsgrab in the middle of the
file has been removed. The program is now available on
my website
and it should soon make its way onto
Sunsite
(and mirrors).
Fourthly, the document has been translated into the Linux Documentation Project SGML Tools content markup language. This markup language can be easily converted to any of a number of other markup languages (including HTML and LaTeX) for convenient display and printing. One benefit of this is that beautiful typography in paper editions is a much more achievable goal; another is that the document has cross-references and hyperlinks when viewed on the Web.
This revision is very much an incremental change. It's here mainly to include changes suggested by readers, one of which is particularly important.
The first change was suggested by Egil Kvaleberg
<egil@kvaleberg.no>,
who pointed out the dump command in debugfs. Thanks again, Egil.
The second change is to mention the use of chattr for avoiding deleting
important files. Thanks to Herman Suijs
<H.P.M.Suijs@kub.nl>
for mentioning this one.
The abstract has been revised. URLs have been added for organisations and software. Various other minor changes have been made (including fixing typos and so on).
The latest public release of this document should always be available in plain text format on the Linux Documentation Project site (and mirrors).
The latest release is also kept on my website in several formats: