Today, I accidentally copied over a file on an ext3 partition. Realizing this but a moment too late, I unmounted that partition hoping that the inode would have survived. No such luck. I managed to run ext3grep
on the right inode, but it had been promptly overwritten by another temporary file, which was then also deleted. However, as I had recently accessed the old file, it was kind enough to share the blocks with me:
--------------Inode 23134365 (transaction 4425320)------------------
Generation Id: 1103481886
uid / gid: 1000 / 1000
mode: rrw-rw-r--
size: 303285
num of links: 1
sectors: 608 (--> 1 indirect block).
Inode Times:
Accessed: 1486910887 = Sun Feb 12 09:48:07 2017
File Modified: 1458521346 = Sun Mar 20 20:49:06 2016
Inode Modified: 1458521346 = Sun Mar 20 20:49:06 2016
Deletion time: 0
Direct Blocks: 75088906 75088907 75088908 75088909 75088910 75088911 75088912 75088913 75088914 75088915 75088916 75088917
Indirect Block: 75072452
Inspecting these blocks, it appears that the file contents are intact. How do I reassemble these direct and indirect blocks into my precious file? It was a PDF, if the file type is relevant.
dd
to get each of the blocks off the disk into individual files, examine the indirect block for the remaining blocks, get them as well. Usecat
to join them together. Hope that they are good. Frequently pdf files are compressed which will make it very difficult to recover the data if even one block is incorrect.dd if=/dev/md0 of=part1 ibs=4096 skip=75088906 count=12
to get the direct blocks; then,dd if=/dev/md0 of=indirect ibs=4096 skip=75072452 count=1
for the indirect block;xxd indirect
will give you the addresses of the remaining blocks (for me they were 32-bits, little-endian):dd
each of those to a new file.