ext4 file recovery with giis-ext4


giis-ext4 is designed to protect certain important directories/files on linux systems that are using the ext4 filesystem.
The binary installation of giis-ext4 has only one dependency. That is : sqlite3, which should be available by default on most linux machines.
Installation of giis-ext4 will need root privileges. You should follow these
steps for both binary and source installation.
Download the latest tar file into your home directory
    wget http://www.giis.co.in/giis/giis-ext4_0.6.tar
Extract the tar file into your home directory, which will create  a new
directory called giis-ext4
    tar -xvf giis-ext4_0.6.tar
Change to the newly created directory
    cd giis-ext4
Now, To install giis-ext4 binary, run the following commands as root-
    sh install_giis_ext4.sh
This script will place the binary in /usr/bin and create the /usr/local/giis/
working directory structure and files.
giis-ext4 configuration
Once you have succuessfully installed giis-ext4 from either the binary or source
code, you need to configure it.
Run the following command as root to configure which directories to protect, how
many levels of directory and how often to look for changes.
Lets start the configuration by running
#giis-ext4 –install
Device Found : /dev/mapper/vg_space-lv_root
 giis : Taking snapshot of current File system
 giis-ext4:Installation begins..
 giis-ext4: header table created
 giis-ext4: file table created
 What’s the maximum directory depth?4

I want to protect four levels of directory depth like (dir1/subdir1/subdir2/subdir3) so enter “4”
Now it prompts for which directories to protect.
 Enter the dirname name,that you would like to protect(Max. 7 directories)
 Enter dirname:/tools
 Press 1 to add/protect another directory else Press 0 to complete: 1
 Enter dirname:/docs
 Press 1 to add/protect another directory else Press 0 to complete: 0

I want to protect files from two directories namely “tools” and “docs” and entered zero “0” to specify
end of directory.
Check for newly files every ‘auto update time’ minutes.
Enter auto update time: 20

Here I specified that every 20 minutes the tool should scan “tools” and “docs” directory for any new files or change in exising files.
If it finds new file or changes to existing files , keep track of it.

 Parsing directory  : /tools
 Parsing directory  : /docs
 *Please add following entry into your /etc/crontab file for auto update
 */20 * * * * root /usr/bin/giis-ext4 -u > /dev/null
 giis-ext4:Installation is complete.

Now append the corntab entry as suggested above,so that it runs for every  20 minutes.
Here is contents on tools directory
# ls -l /tools/
total 120
-rwxr-xr-x. 1 root root 60247 2011-03-17 22:56 cloud-seed.py
-rwxr-xr-x. 1 root root   335 2011-03-17 22:56 dbench_test.sh
-rwxr-xr-x. 1 root root   217 2011-03-17 22:56 iozone_test.sh
-rwxr-xr-x. 1 root root  5644 2011-03-17 22:56 kernel_compile.sh
#ls -l /docs/
-rw-r–r–. 1 root root  461 2011-03-17 22:57 bonnie++.txt
-rw-r–r–. 1 root root   66 2011-03-17 22:57 cpio.txt
-rw-r–r–. 1 root root  199 2011-03-17 22:57 dbench.txt
-rw-r–r–. 1 root root  340 2011-03-17 22:57 small_files.txt

For example here is md5sum of a file-
# md5sum /docs/small_files.txt
0669d98fe55c5e76f8c1841c9f08bf7f  /docs/small_files.txt

Say by mistake , I deleted a file named “small_files.txt”
#rm -rf /docs/small_files.txt
Now the file is gone. Its inode is freed.
Suddenly I realize , in fact small_files.txt was input for another shell script.
Now what would you do?
Relax,since you have configured giis-ext4 for this directory. You may still have chance to recover the file.
Recovering files
# giis-ext4 –recover
 Device Found : /dev/mapper/vg_space-lv_root
 press 1: get all user files
 press 2: get specific user files
 press 3: get specific file type
 press 4: get specific file
 press 5: get it by deleted date
 Enter your option:4

Since we know the exact file name that we wanted to recover – I selected option 4 and entered the file na,e
 Enter the Filename Name….small_files.txt
 Verifing inode:8126486|
 **giis-ext4 : Recovery completed.Please check /usr/local/giis/giis.log for more details and /usr/local/giis/got_it/ for files **

Lets check the log file-
# cat /usr/local/giis/giis.log
/docs/small_files.txt — recovered on — Thu Mar 17 23:22:37 2011

good.It says file “small_files.txt” recorded and placed under /docs directory.
Is it true-
# ls -l /docs/small_files.txt
-rw-r–r–. 1 root root 340 2011-03-17 23:29 /docs/small_files.txt



Yes,seems like the recovered file with same size.
But does it contains same data? Lets verify with md5sum-

# md5sum /docs/small_files.txt
0669d98fe55c5e76f8c1841c9f08bf7f  /docs/small_files.txt

cool.Seems like perfect match.
Other interesting recovery options –
 press 1: get all user files
 press 2: get specific user files
 press 3: get specific file type
 press 4: get specific file
 press 5: get it by deleted date

We have seen how option 4 works.The option 1,just recovers all possible files which are deleted from configured directories.
Option 2 ,will allow to recover files based on its owner.If you want to recover files belong to “Elija”.Simply enter the name with option2.
Enter your option:2
 Enter the User Name….Elija

With option 3,you can recover particular type of files. Say you want to recover only pdf  files.
Enter your option:3
 Make sure you use % before extentions – sql injection 🙂
 Enter the file extention  ( %.txt or  %.c or %.cpp …) :%.pdf

Option 5,It allows you to recover files based on delete dates!.You can recover all files deleted on specific date or within two date ranges or
recover all files deleted after/before a date.
 press 5: get it by deleted date
 Enter your option:5
Get Files by Deleted Date:
    Press 0 : Deleted on
    Press 1 : Deleted After
    Press 2 : Deleted Before
    Press 3 : Deleted Between

Override auto-update time-
While installing,we configured the update time as 20 minutes.
For example, I created an important file -wants to make its protected by giis-ext4,
I’m impatient and can’t wait till 20 minutes.You can add it like-
# giis-ext4 –update
 Device Found : /dev/mapper/vg_space-lv_root
 giis : Updating snapshot of current File system
 Parsing directory  : /tools
inode<7602199>Record already exists
 Parsing directory  : /docs
 giis-ext4:Update is complete.

Now the newly created file is added into giistable.
Viewing list of deleted files with “–list”
Say we deleted couple of files-
# rm -rf /docs/ffsb.txt
#rm -rf /tools/iozone_test.sh
# giis-ext4 –list
 Device Found : /dev/mapper/vg_space-lv_root
 Verifing inode:
File:iozone_test.sh was deleted from /tools/iozone_test.sh.
File:ffsb.txt was deleted from /docs/ffsb.txt.

giis-ext4 recognizes the two files are missing from its inventory.

Th-th-th-that’s all folks!  🙂