Re: [Extundelete-users] only one partition

[<ext...@li...>]

Hi norpois,

The advice to unmount the partition is still relevant.  You could have rebooted using a CD/DVD/USB to run an OS without touching the hard drive any more.  Then, save any recovered files to your USB drive.

That restore-all command should have found anything that extundelete could find, so you didn't do anything wrong.  The output of the log when using the "--log info" option may help determine whether it is a bug in extundelete or you will have to try one of the more time-consuming methods mentioned on the website.

Nic


I would like to use extundelete for recovering a home directory. Unfortunatelty the file system is on one partition /dev/sda1. So I cannout umount /dev/sda1. There is no home partition.
>
>So I tried this:
>
>hugo@pcc253:~$ sudo extundelete /dev/sda1 --restore-directory /home/hugo --output-dir /media/MyDrive/siemens/ # MyDrive is usb hard disk
>[sudo] password for hugo: 
>WARNING: Extended attributes are not restored.
>WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
>The partition should be unmounted to undelete any files without further data loss.
>If the partition is not currently mounted, this message indicates 
>it was improperly unmounted, and you should run fsck before continuing.
>If you decide to continue, extundelete may overwrite some of the deleted
>files and make recovering those files impossible.  You should unmount the
>file system and check it with fsck before using extundelete.
>Would you like to continue? (y/n) 
>y
>Loading filesystem metadata ... 291 groups loaded.
>Loading journal descriptors ... 29419 descriptors loaded.
>Writing output to directory /media/MyDrive/siemens/RECOVERED_FILES/
>Searching for recoverable inodes in directory /home/hugo ... 
>1590 recoverable inodes found.
>Looking through the directory structure for deleted files ... 
>1590 recoverable inodes still lost.
>No files were undeleted.
>hugo@pcc253:~$ cd /media/MyDrive/siemens/
>hugo@pcc253:/media/MyDrive/siemens$ ls
>RECOVERED_FILES
>hugo@pcc253:/media/MyDrive/siemens$ cd RECOVERED_FILES/
>hugo@pcc253:/media/MyDrive/siemens/RECOVERED_FILES$ ls
>hugo@pcc253:/media/MyDrive/siemens/RECOVERED_FILES$ cd ..
>hugo@pcc253:/media/MyDrive/siemens$ ls -l
>insgesamt 0
>hugo@pcc253:~$ sudo extundelete --restore-all /dev/sda1 --output-dir /media/MyDrive/
>WARNING: Extended attributes are not restored.
>WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
>The partition should be unmounted to undelete any files without further data loss.
>If the partition is not currently mounted, this message indicates 
>it was improperly unmounted, and you should run fsck before continuing.
>If you decide to continue, extundelete may overwrite some of the deleted
>files and make recovering those files impossible.  You should unmount the
>file system and check it with fsck before using extundelete.
>Would you like to continue? (y/n) 
>y
>Loading filesystem metadata ... 291 groups loaded.
>Loading journal descriptors ... 29419 descriptors loaded.
>Writing output to directory /media/MyDrive/RECOVERED_FILES/
>Searching for recoverable inodes in directory / ... 
>1616 recoverable inodes found.
>Looking through the directory structure for deleted files ... 
>
>
>
>I both cases RECOVERD_FILES was empty. What was the mistake? Is there a way to save my data?
>
>
>Thanks
>
>norpois
>