Next
Previous
Contents
The next step is to ask the file system which inodes have recently been
freed. This is a task you can accomplish with debugfs . Start
debugfs with the name of the device on which the file system is stored:
# debugfs /dev/hda5
If you want to modify the inodes directly, add a -w option to enable
writing to the file system:
# debugfs -w /dev/hda5
The debugfs command to find the deleted inodes is lsdel . So, type
the command at the prompt:
debugfs: lsdel
After much wailing and grinding of disk mechanisms, a long list is piped into
your favourite pager (the value of $PAGER ). Now you'll want to
save a copy of this somewhere else. If you have less , you can type
-o followed by the name of an output file. Otherwise, you'll have to
arrange to send the output elsewhere. Try this:
debugfs: quit
# echo lsdel | debugfs /dev/hda5 > lsdel.out
Now, based only on the deletion time, the size, the type, and the numerical
permissions and owner, you must work out which of these deleted inodes are the
ones you want. With luck, you'll be able to spot them because they're the big
bunch you deleted about five minutes ago. Otherwise, trawl through that list
carefully.
I suggest that if possible, you print out the list of the inodes you want to
recover. It will make life a lot easier.
Next
Previous
Contents
|