0

Today, I accidentally copied over a file on an ext3 partition. Realizing this but a moment too late, I unmounted that partition hoping that the inode would have survived. No such luck. I managed to run ext3grep on the right inode, but it had been promptly overwritten by another temporary file, which was then also deleted. However, as I had recently accessed the old file, it was kind enough to share the blocks with me:

--------------Inode 23134365 (transaction 4425320)------------------
Generation Id: 1103481886
uid / gid: 1000 / 1000
mode: rrw-rw-r--
size: 303285
num of links: 1
sectors: 608 (--> 1 indirect block).

Inode Times:
Accessed:       1486910887 = Sun Feb 12 09:48:07 2017
File Modified:  1458521346 = Sun Mar 20 20:49:06 2016
Inode Modified: 1458521346 = Sun Mar 20 20:49:06 2016
Deletion time:  0

Direct Blocks: 75088906 75088907 75088908 75088909 75088910 75088911 75088912 75088913 75088914 75088915 75088916 75088917
Indirect Block: 75072452

Inspecting these blocks, it appears that the file contents are intact. How do I reassemble these direct and indirect blocks into my precious file? It was a PDF, if the file type is relevant.

Improve this question
3
  • Use dd to get each of the blocks off the disk into individual files, examine the indirect block for the remaining blocks, get them as well. Use cat to join them together. Hope that they are good. Frequently pdf files are compressed which will make it very difficult to recover the data if even one block is incorrect.
    – icarus
    Feb 13, 2017 at 0:26
  • @icarus why didn't I think of that. Make it an answer, and you get free internet points.
    – Nate
    Feb 13, 2017 at 1:06
  • For future inbound searchers, the exact command I used based off of the output from my question was dd if=/dev/md0 of=part1 ibs=4096 skip=75088906 count=12 to get the direct blocks; then, dd if=/dev/md0 of=indirect ibs=4096 skip=75072452 count=1 for the indirect block; xxd indirect will give you the addresses of the remaining blocks (for me they were 32-bits, little-endian): dd each of those to a new file.
    – Nate
    Feb 13, 2017 at 12:12

1 Answer 1

Reset to default
1

Use dd to get each of the blocks off the disk into individual files, examine the indirect block for the remaining blocks, get them as well. Use cat to join them together (don't include the indirect block). Hope that they are good. Frequently pdf files are compressed which will make it very difficult to recover the data if even one block is incorrect.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .