Sounds From The Dungeon

ReiserFS undelete/data recovery HOWTO

This isn't a proper HowTo or anything, but putting such a title ensures Google indexes this entry nicely in it's database - the database that we all turn to on the first signs of trouble. More on writing for Google.

So web searchers, you've come here because you've lost data on your ReiserFS partition or you accidentally deleted a file and came to know after googling that there's no undelete utility for ReiserFS. I once deleted my entire home directory using the 'rm -rf ./stuff/ *' trick. I managed to recover a lot, but it took time and some googling. The following few steps are to ensure you have better success at recovering lost data.

NOTE: These steps are only for really bad hard disk muck-ups and accidentally deleted files. For normal filesystem inconsistencies, don't use these steps!

1. Once you realize that you've lost data, don't do anything else on that partition - you may cause that data to be overwritten by new data.
2. Unmount that partition. e.g., umount /home
3. Find out what actual device this partition refers to. You can usually get this information from the file /etc/fstab. We'll assume here that the device is /dev/hda3.

4. Run the command: reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hda3

   You need to be root to do this. Read the reiserfsck man page for what these options do and for more options. Some interesting options are '--rebuild-sb, --check'

   After the command finishes, which might be a long time for a big partition, you can take a look at the logfile /root/recovery.log if you wish.

5. Mount your partition: mount /home
6. Look for the lost+found directory in the root of the partition. Here, that would be: /home/lost+found
7. This directory contains all the files that could be recovered. Unfortunately, the filenames are not preserved for a lot of files. You'll find some sub-directories - filenames withing those are preserved!
8. Look through the files and copy back what you need.

UPDATE (15 June, 2004): I just found this thread which warns of possible corruption of existing files on the partition. Essentially, the recovery process may take older (deleted) versions of a current file and try and merge it with the new file resulting in data corruption. As a safety measure, make a backup of important undamaged files on another partition before you carry out the above steps.

Here's a useful link for more advanced tricks.

Hope that helps! Please leave a comment here if you found this page useful and/or if there should be something more on this page that I missed.

PS: For normal filesystem inconsistencies, use the --fix-fixable option with reiserfsck. See the man page for more on that.

techtalk | 7 comments | permalink | 04.06.2004 11:49 MALST