Next Previous Contents

## 8. Finding the deleted inodes

The next step is to ask the file system which inodes have recently been freed. This is a task you can accomplish with `debugfs`. Start `debugfs` with the name of the device on which the file system is stored:

> `

>     # debugfs /dev/hda5

> `

If you want to modify the inodes directly, add a `-w` option to enable writing to the file system:

> `

>     # debugfs -w /dev/hda5

> `

The `debugfs` command to find the deleted inodes is `lsdel`. So, type the command at the prompt:

> `

>     debugfs:  lsdel

> `

After much wailing and grinding of disk mechanisms, a long list is piped into your favourite pager (the value of `$PAGER`). Now you'll want to save a copy of this somewhere else. If you have `less`, you can type `-o` followed by the name of an output file. Otherwise, you'll have to arrange to send the output elsewhere. Try this:

> `

>     debugfs:  quit
>     # echo lsdel | debugfs /dev/hda5 > lsdel.out

> `

Now, based only on the deletion time, the size, the type, and the numerical permissions and owner, you must work out which of these deleted inodes are the ones you want. With luck, you'll be able to spot them because they're the big bunch you deleted about five minutes ago. Otherwise, trawl through that list carefully.

I suggest that if possible, you print out the list of the inodes you want to recover. It will make life a lot easier.

Next Previous Contents