I am trying to restore a directory I accidentally deleted which contained many files. Ironically this was a fat finger error while trying to set up a backup! I am following the instructions here:
The ext4magic command to generate a histogram is successful:
[root] /mnt/reos-storage-2 $ ext4magic /dev/sda2 -H -a $(date -d "-70minutes" +%s)
Filesystem in use: /dev/sda2
|-----------c_time Histogram----------------- after -------------------- Wed Jun 23 10:42:35 2021
1624441775 : 0 | | Wed Jun 23 10:49:35 2021
1624442195 : 43 |**************************************************| Wed Jun 23 10:56:35 2021
1624442615 : 0 | | Wed Jun 23 11:03:35 2021
1624443035 : 1 |** | Wed Jun 23 11:10:35 2021
1624443455 : 0 | | Wed Jun 23 11:17:35 2021
1624443875 : 3 |**** | Wed Jun 23 11:24:35 2021
1624444295 : 0 | | Wed Jun 23 11:31:35 2021
1624444715 : 0 | | Wed Jun 23 11:38:35 2021
1624445135 : 0 | | Wed Jun 23 11:45:35 2021
1624445555 : 0 | | Wed Jun 23 11:52:35 2021
|-----------d_time Histogram----------------- after -------------------- Wed Jun 23 10:42:35 2021
1624441775 : 0 | | Wed Jun 23 10:49:35 2021
1624442195 : 0 | | Wed Jun 23 10:56:35 2021
1624442615 : 1 |* | Wed Jun 23 11:03:35 2021
1624443035 : 9380 |**************************************************| Wed Jun 23 11:10:35 2021
1624443455 : 0 | | Wed Jun 23 11:17:35 2021
1624443875 : 0 | | Wed Jun 23 11:24:35 2021
1624444295 : 1 |* | Wed Jun 23 11:31:35 2021
1624444715 : 0 | | Wed Jun 23 11:38:35 2021
1624445135 : 0 | | Wed Jun 23 11:45:35 2021
1624445555 : 0 | | Wed Jun 23 11:52:35 2021
|-----------cr_time Histogram----------------- after -------------------- Wed Jun 23 10:42:35 2021
1624441775 : 0 | | Wed Jun 23 10:49:35 2021
1624442195 : 33 |**************************************************| Wed Jun 23 10:56:35 2021
1624442615 : 1 |** | Wed Jun 23 11:03:35 2021
1624443035 : 0 | | Wed Jun 23 11:10:35 2021
1624443455 : 0 | | Wed Jun 23 11:17:35 2021
1624443875 : 0 | | Wed Jun 23 11:24:35 2021
1624444295 : 0 | | Wed Jun 23 11:31:35 2021
1624444715 : 0 | | Wed Jun 23 11:38:35 2021
1624445135 : 0 | | Wed Jun 23 11:45:35 2021
1624445555 : 0 | | Wed Jun 23 11:52:35 2021
ext4magic : EXIT_SUCCESS
However, any further commands essentially end in a segfault
[root] /mnt/reos-storage-2 $ ext4magic /dev/sda2 -a 1624442615 -f r sftp_data -l
Filesystem in use: /dev/sda2
Using internal Journal at Inode 8
Activ Time after : Wed Jun 23 11:03:35 2021
Activ Time before : Wed Jun 23 11:56:09 2021
Segmentation fault
Is there anything I can do?
More Background
As background, I got to this point with roughly the following steps.
I unmounted the file system as quickly as I could after frantic googling. Initially I did this with
umount -l /mnt/reos-storage-1
I used the -l option because umount could not unmount the partition which was still in use. Next I did
fuser -cuk /mnt/reos-storage-1/
Next I ran
fsck /dev/sda2
which is not recommended by ext4magic actually.
Next I tried to recover the files with extundelete which failed
[root] /mnt/reos-storage-2 $ extundelete --restore-directory /mnt/reos-storage-1/sftp_data /dev/sda2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 29027 groups loaded.
Loading journal descriptors ... 0 descriptors loaded.
extundelete: Extent block checksum does not match extent block while finding inode for mnt
extundelete: Extent block checksum does not match extent block while finding inode for mnt
Failed to restore file /mnt/reos-storage-1/sftp_data
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name | Inode number | Deleted status
extundelete: Operation not permitted while restoring directory.
extundelete: Operation not permitted when trying to examine filesystem
[root] /mnt/reos-storage-2 $ man umount
[root] /mnt/reos-storage-2 $ extundelete --restore-all /dev/sda2
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 29027 groups loaded.
Loading journal descriptors ... 0 descriptors loaded.
Searching for recoverable inodes in directory / ...
0 recoverable inodes found.
Looking through the directory structure for deleted files ...
0 recoverable inodes still lost.
No files were undeleted.
I then installed ext4magic using apt and ran the following command as in the instructions to make a backup of the journal
debugfs -R "dump <8> /tmp/sda2.journal" /dev/sda2
