Re: recover deleted files?

Theodore Y. Ts'o (
Wed, 4 Dec 1996 19:05:57 -0500

Date: Tue, 3 Dec 1996 17:08:17 -0500 (EST)
From: Travis Woodbury <>

Does anyone know how I would go about recovering some deleted files??
Everything I have been told seems to indicate that it _should_ be
possible (with lots of work) but nothing says how exactly to go about
doing this. I have left the partition mounted read only since soon after
having screwed up. (a MB or two did get copied to the partition before I
realized what had happened). Partial recovery is much better then
nothing at all.

Using the "lsdel" command in debugfs, you can get a list of recently
deleted files on the filesystem. Using the "modify_inode" command
(which granted is not very convenient if you want to undelete a lot of
files), you can set the links_count field to 1, and then run e2fsck to
recover the filesystem.

Note that due to a kernel limitation (which is lifted in the 2.1 kernels
but which is present in 2.0 and older kernels) only the first 12k of a
deleted file can be recovered in this way. Unfortunately, the way the
unlink code worked in the 2.0 kernels destroyed the indirect block

- Ted