Difference between revisions of "Linux Undelete"
m |
m |
||
| (12 intermediate revisions by one user not shown) | |||
| Line 1: | Line 1: | ||
If all of the following conditions applies to your situation then this is the correct resource: | If all of the following conditions applies to your situation then this is the correct resource: | ||
#You deleted a file or directory by accident or otherwise and you wish to have it back again. | #You deleted a file or directory by accident or otherwise and you wish to have it back again. | ||
| − | #You wish it to be a simple process that can be accomplished without rebooting or using other boot media. You are looking for something as straightforward as the Windows Recycling Bin, except on linux. | + | #You wish it to be a relatively simple process that can be accomplished without rebooting or using other boot media. |
| + | #You are looking for something as straightforward as the Windows Recycling Bin, except on linux. | ||
#You are running Ubuntu, Mint, or equivalent. | #You are running Ubuntu, Mint, or equivalent. | ||
If not, then please view the RELATED section for other situations. | If not, then please view the RELATED section for other situations. | ||
| + | |||
| + | The deletion of files in ext3/4 filesystems can not be easily reversed. However the ext4 file system has a feature called journalling. | ||
| + | |||
| + | If you want to see if the journal exists then determine the partition (you can use blkid) and then use dumpe2fs. In this example our ext4 fs is sda2 because our EFI partition is sda1. So the command: | ||
| + | sudo dumpe2fs /dev/sda2 | grep -i journal | ||
| + | The exact contents of the journal depend on how you have configured your ext4 file system. Most people choose installation defaults. There's a packet in debian called sleuthkit, in which you have some tools like jls or jcat. The jls tool can list all journal entries of an ext4 file system. There's also debugfs in e2fsprogs package. It has logdump tool, which is similar to the jls. | ||
=== File Manager === | === File Manager === | ||
The file manager, example N=emo or PCManFM, has the equivalent to a rubbish bin or recovery directory | The file manager, example N=emo or PCManFM, has the equivalent to a rubbish bin or recovery directory | ||
| + | * Open Nemo (file manager) click on Trash in left column and see if it's in there. | ||
| − | Files or directories deleted other ways, such as by software like qBittorrent bypass the rubbish bin or equivalent. | + | Nemo / Nautilus - The rubbish aka trash folder is hard-coded in Nautilus's programming. Both Nautilus and Nemo create hidden folders called .Trash-1000 in any mounted device. |
| + | |||
| + | Also look in the path ~/.local/share/Trash which contains a directory for files and info. Try this: | ||
| + | ls -laF ~/.local/share/Trash/files | ||
| + | |||
| + | The PCManFM rubbish bin can be accessed directly via the PCManFM interface or type: trash:/// | ||
| + | |||
| + | Files or directories deleted other ways, such as by software like qBittorrent bypass the rubbish bin or equivalent. The deleted files do not appear in the Trash directory either. | ||
| + | |||
| + | See also information on gvfs, gvfs-trash, | ||
=== testdisk === | === testdisk === | ||
This utility is useless for file recovery despite all the air headed guides that appear in an Internet search. The limitation is in the file systems that testdisk supports for file recovery. For example on a contemporary Mint Linux installation with default install options the file system type is not supported for undelete file recovery. | This utility is useless for file recovery despite all the air headed guides that appear in an Internet search. The limitation is in the file systems that testdisk supports for file recovery. For example on a contemporary Mint Linux installation with default install options the file system type is not supported for undelete file recovery. | ||
| + | |||
| + | Use the following command | ||
| + | blkid | ||
| + | If you see that you are using TYPE="ext4" then forget about testdisk recovering your deleted file or directory. | ||
=== extundelete === | === extundelete === | ||
This flaming turd can not undelete or otherwise recover a file or directory on a mounted partition. Since basic default Ubuntu or Mint installations done by ordinary users tend to have the root and home partition along with most everything else on the same partition, it can not be unmounted while the system is booted unless you boot to independent boot media or other partition. | This flaming turd can not undelete or otherwise recover a file or directory on a mounted partition. Since basic default Ubuntu or Mint installations done by ordinary users tend to have the root and home partition along with most everything else on the same partition, it can not be unmounted while the system is booted unless you boot to independent boot media or other partition. | ||
| + | === ext4magic === | ||
| + | Also requires you unmount the whole bloody filesystem just to recover a single file! This utility takes advantage of the filesystem journal of ext4. it is often possible, to restore sufficient information for a recover of many data files, directly from the filesystem Journal. ext4magic can extract the information from the Journal, and can restore files in entire directory trees, provided that the information in the Journal are sufficient. This tool can recover the most file types, can recover large and sparse files, recovered files with orginal filename, with the orginal owner an group, the orginal file mode bits, and also the old atime/mtime stamp. | ||
| + | |||
| + | This "seems" to do bulk recovery and require you to unmount the file system. | ||
| + | |||
| + | Ref: [https://ext4magic.sourceforge.net/tips_en.html The direct use of the journal one a read-write mounted file system produces ext4magic errors and wrong results] - A file system should before the use with ext4magic first umounted or mount it read-only. In some cases this will not be possible, and also the loss of only one file will not always justify this expenditure really. ext4magic has an evasion of this problem, which is classified however at present still as experimental for unique smaller actions. | ||
| + | |||
| + | === R-Linux === | ||
| + | This is not FOSS. It is commercial however claims to be free to use. We had the most success using R-Linux as opposed to any other method listed here. | ||
| + | |||
| + | We'll be testing | ||
| + | R-Linux for Debian/Ubuntu Linux platform (64-bit) RLinux6_x64.deb Download Size: 66.41 MB Date Released: Apr 18 2023 Version: 6.2 build 191150 | ||
| + | available on the [https://www.r-studio.com/free-linux-recovery/Download.shtml Download R-Linux for Linux] page of their web site. | ||
| + | The downloaded file is a DEB package "RLinux6_x64.deb" that can be installed easily via. | ||
| + | |||
| + | It seems to install to "/usr/local/R-Linux" and create a launcher. Documentation states, "Basic file recovery can be made for deleted files that has resided on an existing partition visible to the operating system." | ||
| + | # double click partition to ENUMERATE (scan and number) files. This takes awhile. | ||
| + | # navigate to the directory path of your deleted files | ||
| + | |||
| + | If your file or directory is not displayed: Sometimes R-Linux can find the files but not the entire file paths to them. It puts such files into the Extra Found Files folder. Try to search for the files there. If that does not help, try to find them by using file search globally on the entire disk. | ||
| + | |||
| + | In our test we found the video file we were looking for inside Extra Found Files. The name was absent, appears as $InodeJrl2kkd16e8 however using tools like PREVIEW and the HEX VIEWER as part of R-Linux the file was confirmed. Sadly the file was already degraded so the recovered version had errors. | ||
| + | |||
| + | There are many utilities as part of R-Linux that provides options for file or directory recognition, partial or full recovery, or bare minimum scrape of essential data. | ||
| + | |||
| + | * Useful reference for file recovery: [https://www.r-studio.com/free-linux-recovery-help/basicfilerecovery.html R-Linux for Linux Technical Documentation, Basic File Recovery] | ||
== Related == | == Related == | ||
Latest revision as of 13:06, 27 July 2023
If all of the following conditions applies to your situation then this is the correct resource:
- You deleted a file or directory by accident or otherwise and you wish to have it back again.
- You wish it to be a relatively simple process that can be accomplished without rebooting or using other boot media.
- You are looking for something as straightforward as the Windows Recycling Bin, except on linux.
- You are running Ubuntu, Mint, or equivalent.
If not, then please view the RELATED section for other situations.
The deletion of files in ext3/4 filesystems can not be easily reversed. However the ext4 file system has a feature called journalling.
If you want to see if the journal exists then determine the partition (you can use blkid) and then use dumpe2fs. In this example our ext4 fs is sda2 because our EFI partition is sda1. So the command:
sudo dumpe2fs /dev/sda2 | grep -i journal
The exact contents of the journal depend on how you have configured your ext4 file system. Most people choose installation defaults. There's a packet in debian called sleuthkit, in which you have some tools like jls or jcat. The jls tool can list all journal entries of an ext4 file system. There's also debugfs in e2fsprogs package. It has logdump tool, which is similar to the jls.
File Manager
The file manager, example N=emo or PCManFM, has the equivalent to a rubbish bin or recovery directory
- Open Nemo (file manager) click on Trash in left column and see if it's in there.
Nemo / Nautilus - The rubbish aka trash folder is hard-coded in Nautilus's programming. Both Nautilus and Nemo create hidden folders called .Trash-1000 in any mounted device.
Also look in the path ~/.local/share/Trash which contains a directory for files and info. Try this:
ls -laF ~/.local/share/Trash/files
The PCManFM rubbish bin can be accessed directly via the PCManFM interface or type: trash:///
Files or directories deleted other ways, such as by software like qBittorrent bypass the rubbish bin or equivalent. The deleted files do not appear in the Trash directory either.
See also information on gvfs, gvfs-trash,
testdisk
This utility is useless for file recovery despite all the air headed guides that appear in an Internet search. The limitation is in the file systems that testdisk supports for file recovery. For example on a contemporary Mint Linux installation with default install options the file system type is not supported for undelete file recovery.
Use the following command
blkid
If you see that you are using TYPE="ext4" then forget about testdisk recovering your deleted file or directory.
extundelete
This flaming turd can not undelete or otherwise recover a file or directory on a mounted partition. Since basic default Ubuntu or Mint installations done by ordinary users tend to have the root and home partition along with most everything else on the same partition, it can not be unmounted while the system is booted unless you boot to independent boot media or other partition.
ext4magic
Also requires you unmount the whole bloody filesystem just to recover a single file! This utility takes advantage of the filesystem journal of ext4. it is often possible, to restore sufficient information for a recover of many data files, directly from the filesystem Journal. ext4magic can extract the information from the Journal, and can restore files in entire directory trees, provided that the information in the Journal are sufficient. This tool can recover the most file types, can recover large and sparse files, recovered files with orginal filename, with the orginal owner an group, the orginal file mode bits, and also the old atime/mtime stamp.
This "seems" to do bulk recovery and require you to unmount the file system.
Ref: The direct use of the journal one a read-write mounted file system produces ext4magic errors and wrong results - A file system should before the use with ext4magic first umounted or mount it read-only. In some cases this will not be possible, and also the loss of only one file will not always justify this expenditure really. ext4magic has an evasion of this problem, which is classified however at present still as experimental for unique smaller actions.
R-Linux
This is not FOSS. It is commercial however claims to be free to use. We had the most success using R-Linux as opposed to any other method listed here.
We'll be testing R-Linux for Debian/Ubuntu Linux platform (64-bit) RLinux6_x64.deb Download Size: 66.41 MB Date Released: Apr 18 2023 Version: 6.2 build 191150 available on the Download R-Linux for Linux page of their web site. The downloaded file is a DEB package "RLinux6_x64.deb" that can be installed easily via.
It seems to install to "/usr/local/R-Linux" and create a launcher. Documentation states, "Basic file recovery can be made for deleted files that has resided on an existing partition visible to the operating system."
- double click partition to ENUMERATE (scan and number) files. This takes awhile.
- navigate to the directory path of your deleted files
If your file or directory is not displayed: Sometimes R-Linux can find the files but not the entire file paths to them. It puts such files into the Extra Found Files folder. Try to search for the files there. If that does not help, try to find them by using file search globally on the entire disk.
In our test we found the video file we were looking for inside Extra Found Files. The name was absent, appears as $InodeJrl2kkd16e8 however using tools like PREVIEW and the HEX VIEWER as part of R-Linux the file was confirmed. Sadly the file was already degraded so the recovered version had errors.
There are many utilities as part of R-Linux that provides options for file or directory recognition, partial or full recovery, or bare minimum scrape of essential data.
- Useful reference for file recovery: R-Linux for Linux Technical Documentation, Basic File Recovery
