How to recover a deleted file in Linux

A step-by-step guide for recovering files using debugfs

[root@unix-support-server ~]# mount
/dev/sda2 on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/sda1 on /boot type ext4 (rw)
/dev/sdb1 on /var/www type ext3 (rw)
/dev/sdd1 on /LUN93 type ext3 (rw)
/dev/sdc on /LUN92 type ext3 (rw)
/dev/sde1 on /LUN94 type ext3 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
Create a text file called data.txt, enter:
echo 'This is a test' > data.txt
Display the index number (inode) of data.txt, enter:
[root@unix-support-server LUN94]# ls -li data.txt
2113537 -rw-r--r-- 1 root root 15 Jun 9 18:19 data.txt
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# debugfs -w /dev/sde1
debugfs 1.41.12 (17-May-2010)
debugfs: logdump -i <2113537>
Inode 2113537 is at group 129, block 4227074, offset 0
Journal starts at block 25167, transaction 344454
FS block 4227074 logged at sequence 344484, journal block 31233 (flags 0x2)
(inode block for inode 2113537):
Inode: 2113537 Type: regular Mode: 0644 Flags: 0x0
Generation: 1054075619 Version: 0x00000000
User: 0 Group: 0 Size: 15
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x575965d9 -- Thu Jun 9 18:19:29 2016
atime: 0x575965d9 -- Thu Jun 9 18:19:29 2016
mtime: 0x575965d9 -- Thu Jun 9 18:19:29 2016
Blocks: (0+1): 4247552
No magic number at block 31238: end of journal.
debugfs: cat <2113537>
This is a test
debugfs:
debugfs: q
[root@unix-support-server LUN94]# rm data.txt
rm: remove regular file `data.txt? y
[root@unix-support-server LUN94]# cat data.txt
cat: data.txt: No such file or directory
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# dd if=/dev/sde1 of=data.txt bs=4096 count=1 sk
ip=4247552
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.000536678 s, 7.6 MB/s
[root@unix-support-server LUN94]#
[root@unix-support-server LUN94]# cat data.txt
This is a test
[root@unix-support-server LUN94]#
Related Posts:
Howto: Recover a file when you dont know inode number