ReiserFS undelete/data recovery HOWTO

·

This isn’t a proper HowTo or anything, but putting such a title ensures Google indexes this entry nicely in its database - the database that we all turn to on the first signs of trouble. More on writing for Google.

So web searchers, you’ve come here because you’ve lost data on your ReiserFS partition or you accidentally deleted a file and came to know after googling that - unlike ext2, ext3 or fat32 filesystems - there’s no undelete utility for ReiserFS. I once deleted my entire home directory using the ‘rm -rf ./stuff/ *’ trick. I managed to recover a lot, but it took time and some googling. The following few steps are to ensure you have better success at recovering lost data.

UPDATE (15 June, 2004): I just found this thread which warns of possible corruption of existing files on the partition. Essentially, the recovery process may take older (deleted) versions of a current file and try and merge it with the new file resulting in data corruption. As a safety measure, make a backup of important undamaged files on another partition before you carry out the steps below.

UPDATE (31 March, 2005): Make sure you read through all the comments to this howto before starting the recovery process. Lots and lots of invaluable tips and warnings are present in those comments!

UPDATE (11 August, 2005): For even more hopeless data loss cases, try Foremost.

UPDATE (13 March, 2008): Got ext3 and not ReiserFS? Check out this indepth ext3 undelete guide by Carlo Wood. I wish someone would do a similar analysis for ReiserFS.

NOTE: These steps are only for really bad hard disk muck-ups and accidentally deleted files. For normal filesystem inconsistencies, don’t use these steps!

  1. Once you realize that you’ve lost data, don’t do anything else on that partition - you may cause that data to be overwritten by new data.
  2. Unmount that partition. e.g., umount /home
  3. Find out what actual device this partition refers to. You can usually get this information from the file /etc/fstab. We’ll assume here that the device is /dev/hda3.

  4. Run the command: reiserfsck –rebuild-tree -S -l /root/recovery.log /dev/hda3

    You need to be root to do this. Read the reiserfsck man page for what these options do and for more options. Some interesting options are ‘–rebuild-sb, –check’

    After the command finishes, which might be a long time for a big partition, you can take a look at the logfile /root/recovery.log if you wish. 5. Mount your partition: mount /home 6. Look for the lost+found directory in the root of the partition. Here, that would be: /home/lost+found 7. This directory contains all the files that could be recovered. Unfortunately, the filenames are not preserved for a lot of files. You’ll find some sub-directories - filenames within those are preserved! 8. Look through the files and copy back what you need.

Here’s a useful link for more advanced tricks.

Hope that helps! Please leave a comment here if you found this page useful and/or if there should be something more on this page that I missed.

PS: For normal filesystem inconsistencies, use the –fix-fixable option with reiserfsck. See the man page for more on that.

☙