1

Due to this bug, the content of one of my source files was deleted. I searched a lot and found that I can read the raw data on the storage device with the dd command, and I can find the address of blocks that hold my file's data through the hdparm command, but the contents of my file were deleted, and the size of it is zero so hdparm shows nothing.

So I read the entire partition with dd and filtered output with grep and I found a line of my source file, so I am sure that my source file's contents are alive on my storage device. Now I have some questions:

  1. Is there is a optimized way to restore the content of file?
  2. Is it a good idea to delete the file and then recover it with recovery tools?
  3. Is there a way to find the address after finding a line of my source file?
  4. Is there a way to find the addresses of old blocks?
  5. Is there a way to force the grep command to print (for example) 1000 lines after finding the desired line?
  6. I am not familiar with how files are saved in a directory, does the directory have a physical boundary? I mean, can I find the start and end addresses of a directory to read all of the directory's contents? ( I want to read the entirety of my src folder).

Basically, how can I get my fiels back?

Note:

  1. I use the linux.
  2. My partition's file system is ex4.
  3. My storage device is SSD.

Thanks.

ali tavakoli
  • 19
  • 4
  • 1
    Your question 5 is easy. Just use `grep -A 1000` (see `man grep`). Should we assume you are using Linux or is this another operating system? What filesystem are the files stored on? – terdon Mar 20 '22 at 11:35
  • 1
    Files are not stored "in a directory". A directory is simply an index linking a text name to some sort of reference, in Linux this would be an inode number. Depending upon the filesystem there will be some sort of table indexed by these numbers where details about the file and where it is on disk are held. Furthermore, files may not be contiguous but may be fragmented into multiple chunks, the index keeps track of this. When a file is deleted it is typically just marked as free so IF you are very lucky the data may still be there, but unindexed and not referenced from a directory. –  Mar 20 '22 at 11:45
  • The more you use your disk the less likely there will be any of the deleted file's blocks left. Stop using it and instead temporarily switch to using a rescue environment. (I like [SystemRescue](https://www.system-rescue.org/) myself; other people may prefer others.) – roaima Mar 20 '22 at 13:45

2 Answers2

4

Very briefly:

It's complicated, and it depends on your filesystem. You can e.g. use debugfs to poke around in ext2, ext3, or ext4 filesystems. Make sure to properly read up on how the filesystems work, that you understand i-nodes and journals.

If you found some lines of your source files, you can use that to identify the block, which in turn should help you to identify i-nodes or journal entries.

Be prepared to invest at least several days of reading, understanding, and experiments to find out about how all of that works. Also, make a complete backup of your harddisk now, and don't use your harddisk until you've made that backup. Or the reminder of your file may very well be overwritten (if it isn't already).

For the future, I also recommend to use version control on your source files, then loosing a few files due to VSCode bugs is not biggie - at worst you'll have to redo the changes since last commit.

dirkt
  • 31,679
  • 3
  • 40
  • 73
1

I was able to completely recover deleted files after a crash of my computer with ext4magic.

It is an impressive and incredibly powerful tool but also very technical. However the above web site is a treasure of knowledge on the ext4 filesystem.

I did that too long ago to remember how I did it exactly (I can only remember it involved the -r, -m or -I options). But a good start from the above link are the examples of usage scenarios on the same website.

A side note: the English on the site is sometimes very approximative, to such an extent that as a non-native English speaker I had to rely on deepL to translate the original German text to get a more understandable translation. But I guess you are good to go if you are a native English-speaker or even better a German speaker. This is in no way to diminish the impressive work done by the developer to develop the application and gather all this information together, or his effort to translate this documentation at the best of his ability!

The Quark
  • 260
  • 1
  • 11