[Extundelete-users] Is there any chance extundelete can work with a system that has rebooted?
Status: Beta
Brought to you by:
necase
From: <ext...@li...> - 2012-11-11 06:52:51
|
I realized that I was deleting all the files in a big data partition after 99% of the data was gone, I immediately stopped the rsync command that was doing it and knowing that I didn't want the data written over I shut down the system, which I gather was a mistake. The next day I booted the system with a live CD with extundelete on it (SystemRescueCd 3.1.1) and ran extundelete /dev/sdb2 --restore-all. Unfortunately it didn't work. I got: root@sysresccd /root % extundelete /dev/sdb2 --restore-all WARNING: Extended attributes are not restored. Loading filesystem metadata ... 800 groups loaded. Loading journal descriptors ... 31794 descriptors loaded. Searching for recoverable inodes in directory / ... 24478 recoverable inodes found. Looking through the directory structure for deleted files ... Failed to restore inode 11 to file RECOVERED_FILES/lost+found:Inode does not correspond to a regular file. Unable to restore inode 1310721 (Bruce): No data found. Unable to restore inode 2883585 (.Trash-1000): No data found. Unable to restore inode 3670017 (TEMP): No data found. Unable to restore inode 262145 (JBrother): No data found. Unable to restore inode 4194305 (Kwald_pic): No data found. Unable to restore inode 5505025 (Snow Trips): No data found. Unable to restore inode 2621441 (ed): No data found. zsh: segmentation fault extundelete /dev/sdb2 --restore-all So I am guessing that when I shut down the system instead of unmounting the partition or remounting it read-only I hosed the journaling and this program can not help me? I made the target partition noauto,ro in the fstab, so should I try to boot the system and run extundelete from the operating system itself (Debian stable?) Or would I get the same issue and maybe should consider using photorec and foremost to try and rescue my photographs (I tried them and larger files seem to be corrupted). There is another program based on extundelete called ext4magic. It is not in the Debian repositories and was not available on a live CD. Do you think it is worth a shot or am I just out of luck? My backups were out of date and there was a lot of unique data on the partition. Restoring everything to a big pile of unnamed piles with photorec might salvage a few photos, but would be wildly time consuming and frustrating. http://openfacts2.berlios.de/wikien/index.php/BerliosProject:Ext4magic ext4magic is a disk utility to recover files from ext3 or ext4 partitions It is based on ext3grep and extundelete, but was rewritten from scratch. In addition to the tools just mentioned ext4magic handles more file types, also hardlinks and symlinks extracts and using more information from the journal and the filesystem restores owner, group and modification time (optional file attributes) of files and directories can try to find moved and overwritten directories and files and more then one version of a file can extract a lot of useful information about the journal and the journal data itself has a file carving function at the end of a multi-step recover process with different recover methods includes functions tries to recover a partially destroyed file system. Thank you for developing this tool even if it can't save my sorry anatomy. |