# Recovering deleted files under linux
#
# Create ramdisk (2M for example)
dd if=/dev/zero of=/dev/ram0 bs=1k count=2048
mke2fs -v -m 0 /dev/ram0 2048
mount -t ext2 /dev/ram0 /mnt
#
# Find deleted inodes
echo lsdel | debugfs /dev/hda5 | tee lsdel.out
#
# Edit the lsdel.out file for determine what inodes to recover
# and issue next command for filter inodes numbers into inodes file
cut -c1-6 lsdel.out | grep "[0-9]" | tr -d " " > inodes
#
# After next command file stats contains the statistics for all inodes
sed 's/^.*$/stat <\0>/' inodes | debugfs /dev/hda5 | tee stats
#
# Next line automates the recover process
# or you may use debugfs /dev/hda5
# and
# debugfs: dump  /mnt/rec.NNN
# for manually recovering
# this stuff works for files that are not larger then 12 blocks
# for greater files 
# look at http://semantics.soas.ac.uk/~aaron/tech/e2-undel/html/howto.html
sed 's/^.*$/dump <\0> \/mnt\/rec.\0/' inodes | debugfs /dev/hda5
#
# densky ([email protected])
# EOF