ReiserFS undelete/data recovery HOWTO

This isn't a proper HowTo or anything, but putting such a title ensures Google indexes this entry nicely in its database - the database that we all turn to on the first signs of trouble. More on writing for Google.

So web searchers, you've come here because you've lost data on your ReiserFS partition or you accidentally deleted a file and came to know after googling that - unlike ext2, ext3 or fat32 filesystems - there's no undelete utility for ReiserFS. I once deleted my entire home directory using the 'rm -rf ./stuff/ *' trick. I managed to recover a lot, but it took time and some googling. The following few steps are to ensure you have better success at recovering lost data.

UPDATE (15 June, 2004): I just found this thread which warns of possible corruption of existing files on the partition. Essentially, the recovery process may take older (deleted) versions of a current file and try and merge it with the new file resulting in data corruption. As a safety measure, make a backup of important undamaged files on another partition before you carry out the steps below.

UPDATE (31 March, 2005): Make sure you read through all the comments to this howto before starting the recovery process. Lots and lots of invaluable tips and warnings are present in those comments!

UPDATE (11 August, 2005): For even more hopeless data loss cases, try Foremost.

UPDATE (13 March, 2008): Got ext3 and not ReiserFS? Check out this indepth ext3 undelete guide by Carlo Wood. I wish someone would do a similar analysis for ReiserFS.

NOTE: These steps are only for really bad hard disk muck-ups and accidentally deleted files. For normal filesystem inconsistencies, don't use these steps!

  1. Once you realize that you've lost data, don't do anything else on that partition - you may cause that data to be overwritten by new data.
  2. Unmount that partition. e.g., umount /home
  3. Find out what actual device this partition refers to. You can usually get this information from the file /etc/fstab. We'll assume here that the device is /dev/hda3.
  4. Run the command: reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hda3

    You need to be root to do this. Read the reiserfsck man page for what these options do and for more options. Some interesting options are '--rebuild-sb, --check'

    After the command finishes, which might be a long time for a big partition, you can take a look at the logfile /root/recovery.log if you wish. 5. Mount your partition: mount /home 6. Look for the lost+found directory in the root of the partition. Here, that would be: /home/lost+found 7. This directory contains all the files that could be recovered. Unfortunately, the filenames are not preserved for a lot of files. You'll find some sub-directories - filenames within those are preserved! 8. Look through the files and copy back what you need.

Here's a useful link for more advanced tricks.

Hope that helps! Please leave a comment here if you found this page useful and/or if there should be something more on this page that I missed.

PS: For normal filesystem inconsistencies, use the --fix-fixable option with reiserfsck. See the man page for more on that.

Comments

u in NUS by any chance?

Yes, but not for long.

I graduate in a month.

Why? You there too?

indeed, this was by far the best help available and i used google

sadly it was about only the 20th entry or so, it took me some time, but as firefox tabbed browsing ruled, this was quite fast.

i accidentally... no... lets say... i with a slight mistake, killed about 100 binary files. was because of the rm *

that really sux, i think i must implement a script which ensures a talkback function if there are more than 200 files which would get deleted, so that it asks "you are about to delete FOO files in DIR. Continue? yes"...

anyway, right now i am running the test as described...

Skipping 8808 blocks (super block, journal, bitmaps) 19582440 blocks will be read 0%. left 18033511, 7984 /sec

Some update, after about 15 minutes the output looked (btw it was a 80 GIG hard disc, a rather new thing):

Skipping 8808 blocks (super block, journal, bitmaps) 19582440 blocks will be read 0%....20%....40% left 11026904, 8512 /sec

then after this was finished, sth like...

Objectids found 142363

Flushing..finished Syncing..finished ########### reiserfsck finished at Mon Aug 9 15:54:16 2004 ###########

my log was 11.3 MB in size

and i found many entries with

wrong block count in the StatData

i mounted it, changed to lost+found dir

there were incredibly many directories inside

a bit despair came up here ;)

i ran ls -c -l|gr 08-09 to find out which dirs i should have a look in... there i eventually found some of the files i deleted... so i copied some, then switched to the original dir where all the trouble has happened

and lo and behold, there all the files i deleted were again!

is a bit auto-magical to me but hey - the files are there , i have 2 harddiscs, now i use the other harddisc as well to back that data up :)

well, link to this page and bring it up in google's ranking :-D

lucky you! getting all ur files back so easily. especially with those binary files...

Hi all,

I just want to thank for the tips on recovering deleted files. I've just wrongly deleted some files and been able to recover them by following your steps / steps from pages mentioned herein. Instead of finding deleted files in lost+found directory, I've ended up finding them in the original directories (from where they were deleted). I've compiled the sequence of steps for my specific case (slight changes will suit particular issues regarding unwanted file deletion), which follows:

Recover deleted files (from /home = /dev/hda7)
0. Unmount partition from where to recover deleted files

        umount /home
1. Create partition copy
        dd if=/dev/hda7 conv=noerror > /hda7.img
2. Set up device containing copy of partition (created in 1.)
        losetup /dev/loop/0 /hda7.img
3. Rebuild FS tree, performing a thorough partition scan and logging to /recovery.log file
        reiserfsck --rebuild-tree -S -l /recovery.log /dev/loop/0
(4. Check written log file)
        (less /recovery.log)
5. Create directory for mounting recovered partition
        mkdir /recovery
6. Mount recovered partition in directory created in 5.
        mount /dev/loop/0 /recovery
7. Access recovered partition's lost+found directory and look for files
        cd /recovery/lost+found
8. If not there (7.), then look for in original directory
        cd /recovery/
9. Remount /home partition
        mount /home
10. Copy recovered files from 7./8. to /home/
        cp /recovery// /home//
11. Unmount recovered partition
        umount /recovery
12. Detach recovered partition device
        losetup -d /dev/loop/0

@nT$

for saving my four-letters-word... jezz, it was supposed to be a SAFE filesystem... whilst it turned many of my files to directories after one single crash (indeed, it was a heavy one). I couldnt rebuild the structure as "-S" flag works only with "--rebuilid-tree" (didn't know about it).. You helped me a lot!..

A slip of the finger in a Firefox install removed my home directory. Searching the net only seemed to confirm that the only recovery possible was grep. Even the official reiserfs site seems to confirm it is not possible to recover deleted files.

It's been months since the 'accident' and was beginning to think it was time to admit defeat and reuse the partition. I came across your page this evening and followed the procedures and tips above. The result is that I have recovered most (possibly all) of my files, including binaries in excess of 50MB. It's a shame about the names, but that is a small price to pay for having my work back.

Thank you.

Michael

Thanks guys! you really saved me, my sister was going to kill me, no kiddin' :)

Thanks for this how-to. Im restore all my data succesfully

Thanks, as all above had said. I had a machine that was teh h4xxed (or so it appears) and lost 20gigs of photos from photo galleries I'd been hosting for friends. I hadnt backed it up to DVD in about 6months, but this restored all files I care about!

Thank you...

Well, i followed this howto carefully and i arrived to the point where i mounted my partition and get into the lost+found directory, i noticed that there were a Gigantish amount of directories (name corresponding to nodes i suppose) but the corrupted partition i had to rescue was the / partion of a friend. My aim thus is to recovery all possible files and get them back in their original place... Any ideas ?

By the way, thanks for all theses good advices so far. Reiserfs rules!!!

Can you please put the remember to back up thing at the top - i didn't read it and now there seems to be a large issue.....

fixed now.

Ever tried that on the root partition? Last night I have. It's quite fun actually, most files were recovered "in place", and some old files merged with the new ones. Now the machine won't even boot, as the kernel image got corrupted. Using an older image will do, but then almost all my libraries were corrupted too and won't link, and some system tools are broken too...

Word of advice: don't EVER do that without backups, unless you're on a testing box which you planned to reinstall the system anyway ;)

So glad I read through the comments. The file I need to recover actually *is* located on the root partition. I currently don't have a backup, so it's a good thing I didn't just try these steps blindly!

Just adding my list to the people who arrived here and went back with a sense of relief.

I was running an extremely tight deadline, and managed to delete some code that I had spent a few hours developing :).

The tip by @nT$ was wicked cool! The good thing being that everything happens on a backup, so no worries about any kind of corruption to the real parition.

I LOVE YOU!!!

ok, it's a bit exaggerated... anyway, thanks alot!

What if I have format that partition ??

I could not find any singal file in lost+found directory ;-( I did same as mention in above how to. But nothing happance ;-( In log file I got message like vpf-10680: The file [221730 221747] has the wrong block count in the StatData (24) - corrected to (0) rebuild_semantic_pass: The entry [280664 280666] ("icon.png") in directory [280627 280664] points to nowhere - is removed rewrite_file: 2 items of file [51776 52094] moved to [51776 185905] The entry [51776 52094] ("shutdown.xpm") in directory [51776 185762] updated to point to [51776 185905]

I think because of formating everthing get errase . God help me ;(

Thanks to God and Linux Hackers who write down such helpfull documentations. Finally I am able to recover my data back ;-)) It was painful night but got success to get my data back . Such joyful felling :-D you can imagine .

Thank you! It worked great for me. Tried to recover some files on my root partition. Had no harddrive with enough space to make a backup so i just booted with a live cd, ran the command and nearly all my data was back! And no other files were harmed in the process :-) i am just so happy *g*

Just tried this out on a volume of pictures that had been accidently deleted. Worked GREAT - word of warning though, most of my files were recovered IN PLACE - this could be disasterous under some circumstances. In my case it was fine - the partition in question is used only to store images and the files located on it are NEVER edited. If you've been working on files, replacing files, etc there is a good chance you could end up with digital babble instead of what you were expecting since there's no real way to know what the current file is and what are old bits and pieces of it.

Hi there,

came across this as I too had stupidly deleted a vmware file. Fortuanately for me, it was a "secondary" virtual disk with data I could afford to lose, I just wanted the virtual machine (win-xp2) to come up! I managed to do this by editting the ".vmx" file for the virtual machine (after saving a copy ;') and removing the two lines that related to the addition "ide" drive. the system is now up and running. So, while I didn't use the above info, I was able to restore a working (as well as win-xp does ;') system. thanks for your assist,

.h

I accidentally typed 'rm' instead of 'mv' when moving my MythTV video files to a new disk. Fortunately, I had first done a 'ls -l' first, and I saved the output in a file. After following your proceedure, I was able to match the files by the lengths and copy them to the correct location with the right names.

Unfortunately, I was still missing 7 files, but based on a comment above, I found them back in the original directory as if they were never deleted.

I can say how much I thank you!

hwo do you unmount the partition if it's your root dir such as / ??

/ => /dev/hda4

You can boot from a live CD like Knoppix and access the partition. And/OR you can make a copy of the partition using dd as described by @nT$ in a comment above.

Now that many of us have learned a lesson (hard or soft depending on your luck..:o) I would like to point your attention at the libtrash package. It intercepts rm calls at kenrel level and moves the files to a Trash directory. Like "Recycel bin" directory in a M$ Windows environment.

Good to read abt reiserfs, but does anybody have any clue about undeleting from an ext3 fs?

Thanks for my files:) Now let's see what's left on my ext2 partition... (please! don't ask)

Great f***ing tutorial man! Saved 30GB of critical data with this method! THX THX THX!!!

Respect clithe

Oh. my. god.

Greetings from Germany. Thanks there's the Internet (but infact, would i have installed linux without it?). Found this site, first hit on google, could recover my entire 29 GB. Thank you very much.

Had windows xp and installed suse 9.1, worked fine until i copied at about 18 GB music and 4 GB personal documents -> black screen and bye bye linux, no bootloader any more and no access to the system :-(

Installed Linux again on another free partiton, found this site and could recover all, had only rename a couple of files.

Thank you very much.

What feelings. Lost all your personal files from within the last five years. Here they're back again. Hooray -)

Do these steps also work if I accidentally formatted my /home partition?

probably not. try using 'foremost'

I used this method..and it worked..thanks! Problem is, the files are not named correctly (as you know). What is the best way to find what youre looking for?

Secondly, browsing this directory is extremely slow..and takes a LONG time. Probably because their are so many files/directories. What is the best way to quickly browse through these files?

Thanks again.

Thank you so much, several 100s (!)hours of work had been deleted. Having my data back I'm happy again.

Try using the 'file' command to determine a file's contents. Or use nautilus/konqueror which can sort files by their real type (not based on filename extension)

Mostly useful - but things never go wrong quite this simply for me. I have a 250GB SATA driver that has suddenly developed bad blocks - in directories. The total # of bad blocks is probably less than 1% of the drive but that is still alot of bad blocks. The drive WAS about 80% full - as to backup - where do you put 250GB of data and how do you backup a drive with that many bad sectors ? Anyway I have scrounged every free byte on every hard disk I can and copied/moved as much as I could off. Though doing so has been a pain because aparently the SATA drivers can completely lock themselves up on some errors. So this has required numerous reboots. Finally with only about %12 of the drive left to recover - but some very important data, reiserfsck barfs when it hits the first bad sector. If I did not have bad sectors I would not be doing this, and as the drive is under warantee I will certainly replace it - AFTER I get as much of my data back as possible. Right now I am trying badblocks with a non-destructive read-write pass in the hopes of forcing the drive to auto relocate some of the bad blocks, getting a list of the others and somehow getting to where reiserfsck will run to completion.

Important: If you start linux from a CD, it creates a RAMdisk and you manage the recovery from there. When I used the -l /recovery.log the computer hung up after a while, causing damage to file system. So, do not use logfile option if you are running from CD.

When running from a LiveCD, be careful about where you store the log files - it may fill all available memory and crash the computer. It is best to put it on a storage device with lots of space - ie, in the place you are recovering to.

arg 640gb raid 5 array :s going to take some time to rebuild Thanku in advance, ps reiserfs is scary-fast on a 5 drive raid array.

Arg, I didn't read the comments enough, and in an attempt to retrieve one lost photo, I damaged innumerable files on my home partition as older versions were mecilessly merged into the current ones, and blocks were rearranged. Is there anyway to Undo this attempt at undoing? jaminadi AT byu DOT net

umm.. restore from ur last backup?

I had to wait months before I could recover my stuff, because I had to save up to buy a new hard drive. Then I found one cheap on woot.com. So, I'm recovering now, then I'm gonna sell the hard drive!

deleted commercial post

Worked good it is VERY important to unmount the partition immediatly after the disaster! (in special: don´t reboot - as I did...). As it seemed some of my latest modified files are gone, but the rest seems good

Thanks!!!!!

very helpfull, i just deleted my mail folder (2Gb, MH format, so lot of files) and recover almost everything, only about 5 folders had lost the name and structure and maybe 0.5% emails corrupted (but still usable)

now i'm sure that i choose well reiserfs over ext3, as ext3 is alot harder (impossible) to recover all this emails

Hey, thx for the nice instructions!

I was trying to resize my /home partition (that one partition is 70gb) and found out that reiserFS resizing is REALLY EXPERIMENTAL. I had got so far on google as to run reiserfsck --rebuild-tree, however i missed the important bit... I had no idea all my files were in the lost+found dir! thanks

I was lucky to have to perform the restore operation on an LVM2 volume.

Just created a snapshot first, rebuilt the tree on the snapshot, copied my files to the primary volume I was restoring from :), deleted the snapshot and ... that's it.

I even did all of this on a running system!

My Disk was parted like this:
hd1 5G FAT32 primary
Extended 75G
hd5 35G FAT32
hd6 swap 256M
hd7 5G ReiserFS
hd8 10G ReiserFS
hd9 rest ReiserFS
On hd1 was Winf**k-2k
Then I wanted to install Winf**k-98 again because of one game I had.
DAMN!!!!
All partition was lost and I had only a very old Bkup. On hd 7 was all my work of my company. I tried the rebuilt-tool but it couldn't find anything on an extended partition with reiserFS on it. Than I made this:
hda1 5G FAT32
hda5 70G extended
hda6 5G ReiserFS /
hda7 10G ReiserFS /company
hda8 rest ReiserFS /bkup
So, all my data should be in hd8 because my company-partition was above 40G.

Then I used this program:
http://foremost.sourceforge.net/pkg/foremost-1.1.tar.gz
have a look yourself how this program works, but it resored allmost all data I lost.

TRY IT

Sören

thanks! worked more or less for me.

I deleted a lot of important files in my home partition. After applying your procedure, I recovered all the files. Thanks.

Thank you saved me almost full 200GB HD worth of DATA that i thought i had lost when it crashed and got a bunch of bad sectors. Would have been next to impossible to replace.

deleted commercial post

Thank you so much for this tutorial! It helped me to recover about 98 per cent of the valuable data I acidentially deleted on my Ubuntu 5.10 box. So I backuped my 60 GB /home partition to a USB drive. (dd if=/dev/hda7 conv=noerror > /usb_drive/hda7.img). It took a good 96 hours until the backup image had been written to the usb drive! But it was well worth waiting for such a long time. The 'reiserfsck --rebuild-tree -S -l /recovery.log /dev/loop/0' command took another 90 minutes to complete, then I was able to recover 98 per cent of my deleted data. Whithout your tutorial my data would have been lost, that's fore sure. So thanks again for your assistance.

Kind regards, fatman

Thank you for such an important and informative article. Saved me hours of downloads of linux source rpms.

Thanks again.

Thank you SOOO much! This saved me 5GB of files of historical personal value! Now some hints:

How to understand the lost+found filenames. They are numbers of the form XXXXX_YYYYY and I found out that the first part (i.e.) XXXXX is for the directory inode.

That is, let's suppose we find a file called 3003_4004 in /home/lost+found. And we have a user called "foo", whose files we want to recover. If we do

ls -i /home

it will show [...] 3003 foo [...]; gladly telling us that the directory /home/foo has the inode 3003 and that file 3003_4004 once belonged to that directory.

Now for an advanced situation: we have a 5005_42 file in /home/lost+found and there is also a directory called 3003_5005. Well, from the last paragraph we learned that 3003_5005 belongs to /home/foo. But WAIT! 5005_42 belongs to the directory 5005! So u can copy 5005_42 into 3003_5005 and then 3003_5005 to /home/foo then, after crawling into the files/dirs, rename them properly.

Happy knee-deep crawling! And pretty-please someone delete my earlier typo-filled comment!

I've deleted your duplicate comment and thanks for that great tip!

Just 3 thing I've learned 1: back up 2: back up 3: back up. Follow those 3 golden rules of computing

Excellent tutorial, thanks!! and the best i didnt need to buy an expensive software ($499) that does exactly that this tutorial do.

WHOA! Talk about the best all-time-ever google hit! This has saved me more than you know. Many thanks! :)

Ditto *every* positive thing said here. Just saved 20 hours of code. Thank you very much.

Accidentally deleted a snapshot file of a virtual machine in VMware. Used this procedure and found the file back in the lost+found directory. Unfortunally the filename was not there so it was a little bit of a puzzle which file needed to be renamed to the name of the missing file, but managed to restore it after all.

Thanks!

Theo

great, saved me from rewriting a website. : )

maybe it's time I started making some backups somewhere... :P

Do not be too cavalier with this approach. It has saved my ass once, but another couple times I was beyond help. I was able to recover about 30GB from an errant rm * (careful with those tab completions).

Both cases where I was not saved, my data was restored, but not necessarily in the proper order. The filenames and structure looked correct, but the files were completely jumbled (this did make some interesting video files though). Any tips on how to avoid/recover from such an occurance? What created the occurances where I wasn't saved was resizing my home partition to 40M instead of 40G, and bad blocks on a 300G drive (lost about 270G there). For the bad blocks drive, I dd'd the drive to a new drive and operated there.

It is important for user to have a better understanding of data recovery. Most of the users loose their data just because they are unaware of the fact that most of the data that is lost can be recovered. I have sent several people to Disk Doctors Labs Inc from where i have recovered my data and most of the times i have come up with positive results.

Did the steps above as stated, but did not work out so good. I have a Suse box that has a RaidCore RAID 5 card, 4 HDs, in RAID 5 configuration. Well Suse sees it as one huge HD being of 950 GB, back up of this data is not an option, I bough this thing to be a backup option being on RAID 5. Well I accidentally deleted bunch pictures from the 950 GB RAID, remind you that I have about 700 GB full of ISOs, movies, music, videos. So in a quest to recover may be 50 pictures with the step above, now alot of my files are corrupted, the filenames are there but they are not, for example, am mp3 has the name and all but when I do "file" on it it just says data and not mp3 tag, like the good mp3s do.I am even hatting to look any further for other damage. Like always back up back up !!! but in my case it was not an option. By any chance, Any way to reverse this process, get my normal files back in order?

Do to a mishap when using file based disks w/ Xen, things went horribly wrong and I lost several months worth of photos.

I followed the steps, and had (like others) thousands of files in lost+found. For me, since I knew I only cared about the pictures, I wrote a script that grep'd each file for 'Nikon' -- if it matched, I copied the file out and then ran dcparse to ensure it was valid and then renamed and touch'd it based on the dcparse date stamp.

Thanks a million for writing this page, and for making Google find it right off!

hi,

i have a vps server and the partition is mounted at / so i cant unmount it cause its busy. so i booted in "repair mode" with virtuozzo. after that reboot the partition is mounted at /repair but i still cant unmount it :( i just deleted 10 files via ftp but that where 2 month of work... any suggestions? thanks a lot

Thank you very much for this tutorial. I recovered many mp3s that I had deleted.

In 20 years of working with computers I for the first time accidentally deleted something. I've had the largest golden horseshoe known to man shoved so far up my rectum when I speak you think the sun is shining when it comes to not loosing data.

That being said however I'd like to make reference to that saying that goes something along the lines of "when it rains it pours..." ... today I lost a bunch of code totally 2 days of efforts more or less. Unfortunately when I did the above, there appeared to be problems with the partition and instead of the several k in files I was looking for 19G was moved into lost+found, more or less all of /var/home.

Long story short after going through all 19G of data, neither the precise files I was looking for or the data in them were to be found. Son of a bitch.

Thank you thank you thank you! I deleted my /lib directory with a rm -rf /lib /chroot/apache/lib, of course only meaning to delete the chrooted version. This howto has helped me to recover what appears to be the complete /lib directory along with some unwanted files, but I'll live with those :P). It did brake the kernel in the process, probably jumbling up modules or some such, but all that took was a recompile and a rerun of lilo. I am just glad that the system is still alive! Would have taken over 90 hours to reinstall (Gentoo, building all from source), and I have an assignment due in 2 days :).

Regards, Wingot at Wingot dot com

Worked for me too with /root partition... rm * deleted files were back in their directory.. Thanks a lot for saving so much time !! DON'T forget to backup the original partition. Tip : if you have a 2nd machine available, dump your partition through NFS on another disk instead of creating the image on another partition of the same disk, it's really much faster..

My case seems a bit different from the above ones, as it appears not to be the result of any mistake of mine, but either of a cathastrophic hardware or software failure. I am now in the middle of the backup phase and I am beaming all of my 30Gb partition from my laptop over to another computer. During this time-consuming process, I had a good chance to search the internet for clues and to meditate about my present situation. I am not sure what will be the outcome of this, but because I believe it could be of some value for others, I feel I should start writing.

This is what hapened to me: my laptop had been working fine for weeks, and it had been submitted to numerous suspend/wakeup cycles as I carried back and forth from work. Until yesterday.

I had firefox, transmission, gmpc, and one or two command-shell windows open, in what looked like smooth sail to me. Suddenly, I started to feel it getting progressively sluggish. In the beginning I would see my windows being redrawn, then it would take a few seconds to switch from one window to another and eventually all my windows would stop responding. While I still could, I fired up top and it would tell me anything unusual. It was as if the computer decided by itself it was time for a break. In the end, even the mouse stopped responding. During all this process though, since the laptop fan would not stop anymore, I suspected something really bad was going on.

After some 20 minutes of frustration and worry, I decided to reset the computer. This was not the first time something like this hapenned to me. I had seen harddisk crashes and other freak incidents, but I had always been on the lucky side and I could cont on my regularly made backups. Not this time though. It has been a few weeks since my last backup and I have been loading my laptop with tons of pictures taken recently. To make matters even worse, I have a lot of hard work that is now inaccessible to me.

Relying on my experience alone, I used Alt-SysCtl sequence keys to first sync, then umount and reboot my computer. Despite the lack of responsiveness, it all seem to work as expected and after a few seconds I was seeing the Fedora Core 5 reboot screen again. But right there, the seriousness of my situation started to become clear, as the system would come to a halt on a kernel panic. It did not take too long for me to realize the reason. I had lost my home partition!

With my system lost, I booted knoppix and I was able to see that my MBR and partition table were still there, but the / partition would not mount. Too bad I did not take note of the exact message I was getting. I ran reiserfsck on it complained about 1 corruption somewhere, recommending me to re-run it with --fix-fixable option. So I did, and it apparently went through smootly. With a sigh of relief I though I would see all my data again, but it was to no avail. To my dismay, my root partition was now completely empty!

As I said, I am now in the process of backing up the data, and if nobody else suggests on the contrary, I will be trying the afore mentioned steps to see if they will help me recover at least some of my lost data. I will keep a watch on this column for comments of suggestions while I wait. I will also write an update as soon as I have some news.

I appologize for the long post, but I just had let this out. Thansks to the author of this column for sharing his valuable knowledge with us.

Eugene

PS: As I was writing this up on my crippled laptop, I witnessed a quick but dreadful power outage. Thank God I have a UPS.

Thanks a lot!! You saved me a lot of time and provided me piece of mind.

Even though my hopes were low, I followed the above instructions. Everything went trhough pretty smootly and now apparently all my data is back. My lost+found folder contains lots of files, and most of them are junk. My photos and work are all back to their original places. I don't very much care for the system itself. It seems find, but I won't risk it. It is a good moment to sit down and install FC6 from scratch.

Thanks a lot!

Eugene

yes!!! thanks man, now i can search my whole 6-months project documents. only the folder names are not the original one anymore...

Thanks, man. Recovered all my mail with this method.

Works great thanx! I was just trying undelete to see if it works. Now I'am gona shift to reiserfs on my next installation today!!

wahey, i accidentally deleted 10GB worth of stuff i've downloaded... i can spare the bandwidth and time to redownload them. I only recovered about 50% of the files but i got all the folders back, so i know what to get again! this seems to work better on files that are 3 folders deep...

it might be because i accidentally deleted them from "trash" ooops!

cheers for the help, i might reformat and go for ext3fs...

Right ive been a real idiot. I deleted a folder on my Reiser fs however it is an encrypted partition.

Tried to follow the steps above when running the following command

reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hda1

I get the following error

reiserfs_open: the reiserfs superblock cannot be found on /dev/hda1.

Failed to open the filesystem.

If the partition table has not been changed, and the partition is valid and it really contains a reiserfs partition, then the superblock is corrupted and you need to run this utility with --rebuild-sb.

so i run reiserfsck with the --rebuild-sb option however i am still getting the same error. Anybody help me with this one?? Ive kind of lost my dissertation and everything :(

Works great !

Even from a mounted root partition (i could not take the box down) Steps:
$ dd if=/dev/sda3 of=/data/sda3
$ losetup /dev/loop/0 /data/sda3
$ reiserfsck --rebuild-tree -S -l /data/recovery.log /dev/loop/0
answered 'Yes' i do really want to do this :)
$ mkdir /data/recovery
$ mount /dev/loop/0 /data/recovery
and bingo, there were all my deleted files, took a bit of sorting out in de lost+found directory but i managed to get all of them.

It was specially nice from reiserfs to put all the files and dirs i cared about in one lost+found directory.

This saved my day ! (actually since it was code it saved about a month worth of reprogramming)

Thank You

Many Thanks! This WORK.

Nice! For me this command was good too: du -H /mnt/lost+found > /root/list It makes a list with all filenames!

Better do:

du -ha /mnt/lost+found > /root/list

reiserfsck --rebuild-tree -S -l /recovery.log /dev/loop0

Pass 1 (will try to insert 287198 leaves): Looking for allocable blocks .. finished 0%....20%....40%....60%....80%....100% left 0, 257 /sec Flushing..finished 287198 leaves read 40496 inserted - pointers in indirect items pointing to metadata 358546 (zeroed) 246702 not inserted non-unique pointers in indirect items (zeroed) 13276269

Pass 2: 0%....20%....40%..Not enough allocable blocks, checking bitmap...there are 0 allocable blocks, btw

out of disk space Aborted

help i got that message

This is merely hindsight advice.

If you are so fortunate as to have used lvm to hold your ReiserFS, then before you begin to muck about with fscking you can create a writeable snapshot volume and play with that instead of the actual FS.

I've recovered my home directory with reiser4 FS with this command

fsck.reiser4 -u -O --build-fs $device (your partition)

this command recreate all the files you've accidentally deleted.

btw thanks for your guide :D

first the device should be /dev/loop/0 and maybe the .img file is stored in an full hard-disk....check the free disk's space

Thank You Very much!!!

You made my day! I formatted a partition of mine by mistake and lost a lost of valuable information/files.

Thanks to the informations on your site, I know have all important files again.

Thanks a lot!! :-))

is it possible to even repair partitions that cannot be unmounted (e.g. / on a always-on-box) this way?

cool , worked for me too!!

while there is no fix currently for this problem you can solve the problem by expanding underlaying device. One possible solution is to setup a linear array. In the example below I had "out of disk space" with rebuild-tree /dev/loop0, created 1000 block extention file and losetup-ed it as /dev/loop1, created linear array /dev/md0 of /dev/loop0 and /dev/loop1 and ran reiserfsck --rebuild-sb /dev/md0 to fix number of blocks in the filesystem and reiserfsck --rebuild-tree /dev/md0.

1) dd if=/dev/zero of=ext-1000 count=1000 bs=4096 loseup /dev/loop1 ext-1000

2) create linear raid mdadm -B /dev/md0 --level=linear --raid-devices=2 /dev/loop0 /dev/loop1

3) rebuild super block on /dev/md0 reiserfsck --rebuild-sb /dev/md0 Did you use resizer(y/n)[n]:n ... rebuild-sb: wrong block count occured (100000), fixed (100992) ... Is this ok ? (y/n)[n]: y

4) rebuild filesystem reiserfsck --rebuild-tree /dev/md0

Thanks for posting up this HOWTO

some script kiddie gained root access to my gateway/media server last night and nuked 500+ gb of media..

it took 12 hours to rebuild the data, but it looks like i've recovered 90% of it..

thank you again :)

Thx for this hint. Works for me too. Deleted a lot of Protokolls bevor they were backed up :o. An rm -r with the * at the wrong position deleted them and my backup.tar too O_o. Worked fine even on an mounted LVM Partition. Just dd from the /dev/mapper/system-home. Thx a lot

Hi everyone! Few days ago I had a very old file server at work that has crashed. (having lots of bad sectors) It was SeaGate 20gb disk with slackware 10.2 and ReiserFS. I tried everything mentioned above but nothing helped to recover any data. I scanned it few times with HDD Regenerator 1.51 but everytime it showed different number of bad sectors at different places. Just an hour ago i found a freeware program for win that made all the recovery possible. (Hope mentioning the name is not forbiden, if so - sorry!) It was DiskInternals Linux Recovery 1.2. If someone wants to try it should follow these steps: 1. Attach the damaged disk as slave to a working PC with Windows on it (i was using one with win xp pro) and boot to the master disk. 2. When the program is started it will ask you to choose from a list of disks where there are two options: choose the phisical disk or the partition. If you know exactly witch partition you have to recover than choose it. Then the program will mount the partition and search for any files in it. After the search is complete it will list all directories and files exactly as they were in the original disk. If for any reason the prog can't determine the plase of a file you'll find it in a folder named 'lost_found'. 3. Select all data that you want recovered click on the "Recover" button in top of the window and the prog will ask you where to place the recovered files. Choose where and it will start transfering to this location. When done saving you'll have all your data back!

P.S Try making back up more often now :-)

P.S.2 Once again sorry if mentioning programs names if not allowed.

Hello, I have a problem which I cannot solve using Your method. Ok, I have a reiserfs partition which is mounted via /dev/loop0 and the low-level access to disk is done via it. Recently the data in one large text file got corrupt (beginning of the text is Ok, end of the text is replaced with binary symbols) Somewhy when I tried your method, I got numerous complaints that /dev/loop0 is not a valid partition. Any ideas ???

nicosaturno.....I owe you HUGE!!!

You saved my arse in a major way with that command!!!

Just recovered very important data! Thanks a billion!!!

Thanks for this page. I'd spent over a day working with various methods to recover a file, all of which did not work with reiserfs. Using this method recovered a 2 gig file which contained my perl script I've worked on for over a year, albeit with lots of junk with it and not in the proper order. I'm restoring from my last backup (about 2 months ago), but using this method made me believe that there's no way to get it back instead of the tools just not running.

This is a great page. Take the advice on backing up before you do it as attempting to recover a whole / partition will often lead to corruption of system files. Before restoring the backup, it combined old and newer versions of a sufficiently large number of system files that the machine would not boot and even a LiveCD chroot would hang and fail (not exactly sure why on this one as the shell was not [to my knowledge] altered). If you are careful about the backup, this method rules!

Thanks for the tip - it was useful after a bad rsync command killed my music. I didn't really want to move everything back by hand, so here's a little C program to do that - note, it doesn't rename them, but it at least puts some of it back where it goes.

http://roysjosh.googlepages.com/reiser-inode-fix.c $ gcc -W -Wall -std=c99 -pedantic -s reiser-inode-fix.c # /path/to/a.out /mnt/sda4/usr /mnt/sda4/lost+found

etc etc.

Thanks again, and I hope this helps.

Sad, Sad, Sad, I stupidly delete some files I needed for some job, I booted with a LiveCd, follow the steps above and voila, the deleted files was in Lost+Found but sadly my system wasn't bootable anymore, all the shared libraries were "deleted" in some way. I supposed that this method was SAFE. Thanks anyway.

Big problem, hopefully this helps.

I have a 320gb (binary ~290gb) HD, where i accidently deleted the encrypted partition containing all my peronal data. I created a new encrypted partition with the same size and i'm just dumping the content to an image file(to a smb share in my LAN...)

so any tips... cause i think the complete superblock is brocken...

AND I NEED THAT DATA:.fuck

Thanks for the tip. In my case I tryed to recover a 3.5GB rar file. when extracting the recovered file, I got lots of CRC errors. It works, but in some situations recovery is not perfect.

Wow, very nice howto :) I will print out this article.

REISERFSCK has finished job (I have full log file - 5,1 MB) and found many files and moved to /HOME/LOST+FOUND.

I didn't make any copy of this partition before, becouse I didn't have any so big disk.

But there is problem now - many of files just dissapeared or are broken. I need Your help :((( I have to fix this today, these files are very important for this company :(

I was getting the "reiserfs_open: the reiserfs superblock cannot be found" on an image created with

dd if=/dev/hda7 conv=noerror > /hda7.img

Instead I used:

dd if=/dev/hda7 conv=sync > /hda7.img

And the superblock error was gone. I didn't have to use "error" because I had only deleted files, there were no other filesystem problems.

oops I meant to type I didn't have to use "noerror"... I only had to use "sync" as an option to dd

If you have physical damage, try http://www.gnu.org/software/ddrescue/ddrescue.html instead of dd

On ubuntu you want to use

losetup /dev/loop1 sda1.img

(instead of /dev/loop/0 when running on the live CD, loop0 is taken)

and to remove that device if you need it:

losetup -d /dev/loop1

Thanks Steve for all the tips!

This method is certainly not safe. The backup is necessary because it will trash most of the files on the system in really unpredictable ways. Do not use this on your actually boot disk, use it on the backup, or you will be sadder and wiser in ways that you dont want to be. Many documents claim it is safe, but its not.

thanks man ! take care.

Many thanks for saving my ass, I mean my data. I lost 76GB and got it all back except for a couple files. You gotta watch what is highlighted in Konqueror before you delete! :)

All of you who ended up here are failed to do backup so next time do it! Before you --rebuild-tree you do a backup, there is a reason why reiserfsck warns you (of course if the partition still mountable).

Another advice is to keep more smaller partition when you buy 500Gb hard drive (which is pretty standard nowadays). Simply because if 1 partition fucks up from any reason you have time to save your data from the others and are you bother recovering rootfs? You should never put everything to 1 big partition /root, at least not your /home directory.

If you dealing with USB, firewire devices and you get errors from reiserfsck in normal mode about uncorrectable events. First you should disconnect and turn off the drive and check its cable before you do rebuild tree. Do this at least 2-3 times because there is a very good chance that its just a transmit error. Anyhow my external hdd were doing this for a month, thats how it ended up corrupting the fs at the end.

I guess many of you dropping reiser for good since it not look that way that anyone will continue the development and the official domain for the project is gone as well.

Many thanks! i recovered my home folder completely, it makes me take more care of my data:)

Worked a treat - thanks

Thanks

I had about 150000 (yes, 150k!) files/dirs in lost+found. I started write my own prog, but i found yours, so i doesn't needed write with my angry face :) Works like a charm: moved the files back. Thanks for sharing. Thanks!