Saturday, June 05, 2010

extundelete to the rescue!

So..in usual fashion, I had a minor foul up today. I was overzealous in my desire to reclaim disk space and zapped some primary source vids off of my ext4 partition. Ooops. Thankfully, I found extundelete, a program that scans ext3 and ext4 filesystem journals and recovers files from those journals:
http://extundelete.sourceforge.net/

Process
Here's what I did to recover the files.
1) In order to prevent the deleted files being overwritten, I immediately stopped whatever work I was doing and unmounted the drive that the files were on. In my case:
umount /dev/mapper/vg_ogre-lv_root

2) Well, that's my root drive. So before rebooting to my Fedora 12 Live CD, I checked that Fedora had the extundelete program in its repository. I was in luck!
[root@localhost ~]# yum install extundelete
Loaded plugins: presto, refresh-packagekit
fedora/metalink

20 kB 00:00
fedora
4.2 kB 00:00
fedora/primary_db
9.7 MB 00:10
updates/metalink
16 kB 00:00
updates
4.5 kB 00:00
updates/primary_db
4.3 MB 00:01
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package extundelete.i686 0:0.1.8-2.fc12 set to be updated
--> Finished Dependency Resolution

You can also compile from source at the link above.

3) Since extundelete requires you to access an unmounted filesystem, I rebooted to Fedora 12 Live CD

4) I installed extundelete from the Fedora Updates repository
Transaction Summary
Install 1 Package(s)
Upgrade 0 Package(s)

Total download size: 52 k
Is this ok [y/N]: y
Downloading Packages:
Setting up and reading Presto delta metadata
updates/prestodelta
4.4 kB 00:00
Processing delta metadata
Package(s) data still to download: 52 k
extundelete-0.1.8-2.fc12.i686.
rpm 52 kB 00:00
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
Installing : extundelete-0.1.8-2.fc12.i686
1/1

Installed:
extundelete.i686 0:0.1.8-2.fc12

Complete!

5) In order to restore deleted files, you must have a partition mounted that has enough space for the recovered files. I have a second partition (/mnt/backups) that I use to backup my main root partition. So while running under the Live CD, I created a destination directory and mounted /mnt/backups:
[root@localhost /]# mkdir /mnt/backup[root@localhost /]# mount -t ext3 /dev/mapper/vg_ogre-lv_backup /mnt/backup

6) Though you can specify that extundelete undeletes individual files or all files on a filesystem, I ran extundelete with the proper command switches to undelete an entire directory of files.  Note that you should be in the directory that has plenty of space for the restore, as extundelete defaults to restoring what it finds to the present working directory:
[root@localhost backup]# extundelete /dev/mapper/vg_ogre-lv_root --restore-directory "mnt/videos/stormpigs/20100408"

WARNING: Extended attributes are not restored.

Loading group metadata ... 27025 groups loaded.


Loading journal descriptors ... 30695 descriptors loaded.


Writing output to directory RECOVERED_FILES/


Searching for recoverable inodes in directory mnt/videos/stormpigs/20100408 ...

309 recoverable inodes found.

Looking through the directory structure for deleted files ...
Restored inode 2495842 to file RECOVERED_FILES/mnt/videos/
stormpigs/20100408/20100408_2.m2t

Restored inode 2495844 to file RECOVERED_FILES/mnt/videos/
stormpigs/20100408/20100408_3.m2t

Restored inode 57147521 to file RECOVERED_FILES/mnt/videos/
stormpigs/20100408/vadd.txt

Restored inode 57147522 to file RECOVERED_FILES/mnt/videos/
stormpigs/20100408/aadd.txt

Restored inode 57147525 to file RECOVERED_FILES/mnt/videos/
stormpigs/20100408/temp.txt

Restored inode 57147528 to file RECOVERED_FILES/mnt/videos/
stormpigs/20100408/test.xml

Restored inode 57147532 to file RECOVERED_FILES/mnt/videos/
stormpigs/20100408/testLabels.sh

Success..or close enough to it
This is good..I've undeleted all but one of the files I had deleted. So, it looks like before I unmounted my root partition, the inode for "20100408_1.m2t" was overwritten. Oh well, two out of three ain't bad.

Update 2011/10/05
This works nicely with ext4 partitions as well.
*** end update ***

Anyway, this short post should give you some comfort that extundelete actually does what it is supposed to. Thanks number9652!!

Reference
http://extundelete.sourceforge.net/
http://sourceforge.net/mailarchive/forum.php?forum_name=extundelete-users

2 comments:

gavin said...

Apologise for being off-topic and possibly for asking again (if my google account was okay the first time around), but I am very keen to use a smaller font size in Cinelerra as per your more recent screen-shots. Can you please advise as to how to achieve this. Many thanks in advance.

Cacasodo said...

Gavin,
That is strange..I'm using Cinelerra Monty (http://crazedmuleproductions.blogspot.com/2010/07/green-beret-parachutes-in-to-help.html) compiled from source on Fedora 12, x86-64. I didn't do anything special in compiling Cin to get the smaller font size. Just came that way out of the box. Also, I haven't done anything special to GNOME to configure fonts specifically.

Here is the list of font related softwares I have installed:
ogre Downloads]$ yum info font* | grep Name
Name : font-manager
Name : fontconfig
Name : fontconfig
Name : fontconfig-devel
Name : fontpackages-filesystem
Name : fontaine
Name : fontbox
Name : fontbox-javadoc
Name : fontconfig-devel
Name : fontforge
Name : fontforge
Name : fontforge-devel
Name : fontforge-devel
Name : fontmatrix
Name : fontpackages-devel
Name : fontpackages-tools
Name : fonts-ISO8859-2
Name : fonts-ISO8859-2-100dpi
Name : fonts-ISO8859-2-75dpi
Name : fonts-KOI8-R
Name : fonts-KOI8-R-100dpi
Name : fonts-KOI8-R-75dpi
Name : fonts-hebrew-fancy
Name : fonttools

hope this helps,
da mule