A folder with backup files was accidentally deleted from the /home partition on a Ubuntu 20.04 machine. All files in the folder were backups (zip) of the same thing (a Minecraft world) but from different dates. As it would be enough to get back only one of the 30 newest files a saw a good chance to recover at least one of them.
I removed /home (which is a separate mount) from fstab, enabled root login, rebooted the machine and logged in as root. I first tried to recover the file using extundelete, and it seemed to find the file but was not able to recover it. I tried several of the lost files and got the same output:
root@arne:~# extundelete /dev/sdb1 --restore-file 'TBS_world-2021-10-09.zip'
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 4456 groups loaded.
Loading journal descriptors ... 0 descriptors loaded.
extundelete: Extent block checksum does not match extent block while finding inode for TBS_world-2021-10-09.zip
extundelete: Extent block checksum does not match extent block while finding inode for TBS_world-2021-10-09.zip
Failed to restore file TBS_world-2021-10-09.zip
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name | Inode number | Deleted status
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem
Next I tried ext4magic, which clearly detected the 423 deleted files:
root@arne:~# ext4magic /dev/sdb1 -H -a 1640202942 -b 1640203868
Filesystem in use: /dev/sdb1
<...snip...>
|-----------d_time Histogram----------------- after -------------------- Wed Dec 22 20:55:42 2021
1640203034 : 0 | | Wed Dec 22 20:57:14 2021
1640203126 : 0 | | Wed Dec 22 20:58:46 2021
1640203218 : 0 | | Wed Dec 22 21:00:18 2021
1640203310 : 0 | | Wed Dec 22 21:01:50 2021
1640203402 : 0 | | Wed Dec 22 21:03:22 2021
1640203494 : 0 | | Wed Dec 22 21:04:54 2021
1640203586 : 0 | | Wed Dec 22 21:06:26 2021
1640203678 : 423 |**************************************************| Wed Dec 22 21:07:58 2021
1640203770 : 0 | | Wed Dec 22 21:09:30 2021
1640203862 : 0 | | Wed Dec 22 21:11:02 2021
<...snip...>
ext4magic : EXIT_SUCCESS
Trying to look for any of the files gives promising output, but actually recovering the file says it can't be found:
root@arne:~# ext4magic /dev/sdb1 -f albin/Backups/TBS_world-2021-10-10.zip -l
Filesystem in use: /dev/sdb1
Using internal Journal at Inode 8
Inode found "albin/Backups/TBS_world-2021-10-10.zip" 18350376
Inode 18350376 is a directory but not found after 1640359705 and before 1640446105
ext4magic : EXIT_SUCCESS
root@arne:~# ext4magic /dev/sdb1 -f albin/Backups/TBS_world-2021-10-10.zip
Filesystem in use: /dev/sdb1
Error: Filename "albin/Backups/TBS_world-2021-10-10.zip" not found in Filesystem
if "albin/Backups/TBS_world-2021-10-10.zip" deleted, use InodeNr or try Journaling options
Running testdisk shows the deleted directory, but the contents can't be accessed. It says the file system may be damaged.
TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <[email protected]>
https://www.cgsecurity.org
1 P Linux filesys. data 2048 1167943679 1167941632
Directory /albin/Backups
No file found, filesystem may be damaged.
Any idea why these errors occur? It looks so promising with all tools, but it fails in the end. It seems plausible that at least one of the lost files should still be there without corruption. I don't understand why I get the errors I get.
