[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

extundelete usage

I need to recover a deleted file (no backup available obviously). The file was


As soon as I deleted it, I realized it was the wrong file to delete and I unplugged the power chord. Then I booted systemrescuecd and mounted the filesystem readonly.

root@sysresccd /mnt % mkdir /mnt/linux
root@sysresccd /mnt % mount -o ro /dev/mapper/vg0-root /mnt/linux

However the file wasn't there anymore:

root@sysresccd /mnt % ls /mnt/linux/var/lib/libvirt/images/i5s.raw
ls: cannot access /mnt/linux/var/lib/libvirt/images/i5s.raw: No such file or directory

I unmounted the filesystem and made a block level working copy with dd onto /dev/md1 (a raid volume I created for the task).

Finally I tried with extundelete:

root@sysresccd /mnt % extundelete --restore-file var/lib/libvirt/images/i5s.raw -o /mnt/custom/ /dev/md1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 14900 groups loaded.
Loading journal descriptors ... 30765 descriptors loaded.
Unable to restore inode 64618558 (var/lib/libvirt/images/i5s.raw): No undeleted copies found in the journal.
Unable to restore file var/lib/libvirt/images/i5s.raw
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem

Some questions:

1) Does "Unable to restore inode 64618558" mean that extundelete actually found my file at that inode, but it cannot recover it for some other reason?

2) What does "No undeleted copies found in the journal" mean? I guess that if there where undeleted copies, I'd already had recovered my file, right?

3) Why am I getting "Operation not permitted"? Can that be the reason why extundelete cannot recover it? But I'm root...

4) Is there any chance I can recover that file in this situation?

Thanks in advance for any help.

Reply to: