Arch Linux

scossu

Member

Registered: 2018-01-08

Posts: 20

Cannot find recently deleted folder with ext4magic or extundelete

Hi,
I have accidentally issued

python -m venv --clear

in a project folder where I had my development data alongside with my Python virtual environment (I usually set up the virtualenv in a subfolder to avoid exactly this). This wiped out all my configuration folder and git repository which I have not pushed to a remote in some time.

The deleted directories are on a LUKS-encrypted (/dev/mapper/home) ext4 filesystem mounted on /home.

The steps I took minutes after I deleted the files were:

- Quickly search for undelete tools online (this may have written some data on the home partition)
- Pacman-install extundelete and ext4magic
- Exit X and log into tty as root
- Unmount /dev/mapper/home
- (some time passed here, about 30')
- Make a copy of the journal:

debugfs -R "dump <8> /var/tmp/home.journal" /dev/mapper/home

- Reboot the system (OK, don't ask why)
- Remount /dev/mapper/home read only
- Try to restore the files (on /home/me/code/project/src) with extundelete:

extundelete --restore-all /dev/mapper/home -j /var/tmp/home.journal

- The above yielded no errors but also found no deleted files to recover.
- Create a histogram of changed files:

ext4magic /dev/mapper/home -H -a $(date -d "-1 day" +%s)

- I can see a large amount of files recorded as deleted around the expected time.
- Try to recover with ext4magic:

ext4magic /dev/mapper/home -a $(date -d "-1 day" +%s) -R -j /var/tmp/home.journal

- This recovers a lot of Python library files (I assume the ones overwritten by the venv command) but not my code.
- Try to list individual deleted files:

ext4magic /dev/mapper/home -a $(date -d "-1 day" +%s) -l -f me/code/project -j /var/tmp/home.journal

- This lists a few files, supposedly the ones that were replaced by the venv command, but not the directories that were wiped as not part of the virtual env.
- Try to list all files (remove -l option):

ext4magic /dev/mapper/home -a $(date -d "-1 day" +%s) -f me/code/project -j /var/tmp/home.journal

- This shows the deleted inodes that I was looking for. e.g.

< 3432501> d  755 (2)   1000     994             4096 21-jun-2018 18:19 src

But no child inodes.
- Removing the "-a" option I get:

< 3432501> d  755 (2)   1000     994                  0 28-jun-2018 18:19 src

(June 28th is today)

I am at a loss at this point. Is this inode recoverable? Could it be that I waited too long to copy the journal and the inodes are definitely lost? I am no filesystem expert so bear with me, but I know enough not to remount the /home partition R/W until I know what to do.

Thanks for any help you can provide.

Last edited by scossu (2018-06-29 00:13:45)