Days like these inconspicuously start out just like any other day,
except on days like these you accidentally manage to erase
have no real backup to rely on … Maundy Thursday will forever be Black
Thursday for me, from now on.
Best thing your can do, after cursing at yourself constantly for a
couple of hours, is to:
- Come up with a useful backup and restore strategy
- Read up on undeletion tools for Ext4
- Blog about it, naturally
BUT FIRST – QUICK – UNMOUNT OR POWER-OFF YOUR COMPUTER – PULL OUT THE
BATTERY – AND STEP AWAY FROM THE COMPUTER! Must protect the partition
from being accidentally written to – I completely fumbled this step, so
take heed young people!
Now calm down and act like an engineer again.
There exist two neat tools, three if you count the more hard core
Both have been around a while, and both are capable of restoring all
files. See their respective home pages for details.
My system used LVM, of course, to make things a bit harder. That’s why
I’m documenting my steps here:
- Remove disk from lappy
- Prepare to connect using USB cradle to workstation, prepare don’t
do it yet! I did the next few steps as root on my workstation,
that’s right, I didn’t care anymore at this point. The world may as
- You haven’t connected the disk yet, right stupid? Most systems today
have cool features like automount that would cause the journal to be
replayed – WE DO NOT WANT THAT OK? OK!
You need the lvm tools:
apt-get install lvm2
vgchange -ay ubuntu-vg
The last command should list your logical volume group(s), in my case
ubuntu-vg. To be able to run
the partition you have to mount the partition, read-only needless to
mount -o ro /dev/ubuntu-vg/root /rescue
Now we try some fairy dust:
ext4magic /dev/ubuntu-vg/root -r
OK, so let’s see:
ls -l RECOVERDIR/
The results between
extundelete may vary, so try them
both out, test different options, and maybe even look at
we’re desperate after all.
extundelete /dev/ubuntu-vg/root --restore-all
ls -l RECOVERED_FILES
If there’s a LOT of files you may have some luck narrowing down the
result using the
--after DATE option … where
DATE is the number
of seconds since the UNX epoch:
extundelete /dev/ubuntu-vg/root --restore-all --after 1458802800
ls -l RECOVERED_FILES
I found my magic number using
date -d "Mar 24 8:00 2016" +%s
Well, as I said, I didn’t turn off my computer in time. Instead I took
the braindead option of starting to google for solutions. So all my
files (with proper filenames) turned out to contain only cached files
from the browser – reclaiming the blocks goes quick, so watch out kids.