Start LDE as root - this is one case where being root makes sense.
LDE will now check the disk for filesystem and if says ext2fs all is well provided of course that’s what the disk is formated as.
Click to view image of flags
Press I to go to inode mode.
This will place at inode 2 the root directory, highlight the block number and press 'd'.
The highlighed block is the first block in the directory.
In the example shown the directory is only one block
Although not part of this talk you can from this screen directly edit theinode so be careful.
Now you should be present with a window with a directory listing in it, if the filenames don't fit the are truncated on the display only.
Use the arrow keys to navigate your file system.
Items in green have been deleted from the directory and items with a D next to are inodes with zero link counts.
The next screen shot shows us having descended into the directory structure and show typically what you would see at this level.
Notice “..” is shown as undeleted.
Notice the “.” is delete but still linked into directory structure.
Also notice that the directory “httpd” now looks like a file, this can’t be recovered from here. It maybe lost for ever.
Notice on the top display the directory is shown as “./home” this is ok. When you select directory view LDE considers the directory you started from as the root directory. This also allow stepping though unrooted directory trees.
Once you reach the file you wish to recover move the cursor over it. Now you have several choices.
e - Edit the directory Block [not done yet]
r - Restore or undelete this entry
t - Checks entry to see if it can be recovered
c - Copies directory name and files contents to new location
The “r” command will complain if its not happy and do nothing, but if the command does restore the entry you must run fsck -f before mounting the disk or you run the risk of data corruption. This is because the bitmaps are not adjusted to the blocks are allocated again and the link counts are set to one.
The “t” command does what it says checks to see if the file is free and able to be recovered.
Finally the “c” command copies the file to the /lost+found directory. These command are just a key press and away they go. So if we want to copy our selected file we just press “c”. And our file should now be found in the lost+found directory.
At this stage of LDE the copy is probable the best choice to rescue that file cause it makes no changes to the disk with the deleted files and its quite quick.
Copy bugs ctime is lost and is currently hard coded to lost+found. Does not handle directories.
To access very basic help type ? This brings up a small help screen.
Next Contents Prev