How to get deleted files inode from super block
Author Message
Posted : Thu, 24 April 2008 09:23:11
Subject : How to get deleted files inode from super block
Hello, We are trying to recover deleted files and directories from Linux filesystem, I had gone through some articles regarding recovery of deleted information. According to them, when the files/directories are deleted from the system respective inodes link will be removed from the dentry and that inode will be marked as free under superblock without removing(freeing) the actual contents of the inode and data block. So, I wanted to know about the deleted files/directories inode. Or, the inodes which are marked as free under superblock [b] Please suggest or send me a sample code… [/b]
Shashank Sharma
Posted : Tue, 29 April 2008 12:54:21
Subject : How to get deleted files inode from super block
Look through these links. I'm sure you'll find something of interest: http://www.linux.com/feature/126525 http://www.faqs.org/docs/Linux-mini/Ext2fs-Undeletion.html Cheers!
AR
Posted : Tue, 06 May 2008 16:07:35
Subject : Re: How to get deleted files inode from super block
If it's EXT3 unfortunately you can not. [url]http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html[/url] quote: [quote] Q: How can I recover (undelete) deleted files from my ext3 partition? Actually, you can't! This is what one of the developers, Andreas Dilger, said about it: In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone. Your only hope is to "grep" for parts of your files that have been deleted and hope for the best. [/quote]