ReiserFS File Undelete HOWTO

From CGSecurity
Jump to navigation Jump to search

En.png English De.png Deutsch Es.png Español Fr.png Français It.png Italiano

If you accidentally deleted some files from a ReiserFS partition, don't loose hope, you may recover your data following this howto. In this example, the ReiserFS filesystem is mounted on /home directory and the ReiserFS device is /dev/hda1.

As root, unmount the ReiserFS partition where the deleted files are

umount /home

If you can not umount the partition (umount: /home: device is busy), try again in single user mode

init 1

or even better, boot from a Linux Live cdrom.

Backup the partition. It is highly recommended to backup the current partition after booting from a Linux Live cd. This will create a file of your whole disk. It is best to create this file on a different disk of equal or bigger size than the disk you are trying to recover the deleted files from. If the original hard disk was 40 Gb, you should be creating this file on another disk with 40 GB or more.

dd if=/dev/hda1 of=reiserfs.dd bs=4096 conv=noerror

Undelete the files by scanning the whole partition

reiserfsck --rebuild-tree --scan-whole-partition reiserfs.dd

Create the mount point

mkdir /mnt/recovery

Mount the image on this directory

mount -o loop reiserfs.dd /mnt/recovery

Some recovered files will be at their previous location but most recovered files will be in /mnt/recovery/lost+found. Now remount the original partition

mount /home

and copy the recovered files to the original place.

For desperate cases, you can also try PhotoRec.