Online Expert Day - HPE Data Storage - Live Now
April 24/25 - Online Expert Day - HPE Data Storage - Live Now
Read more
cancel
Showing results for 
Search instead for 
Did you mean: 

recovering inodes

SOLVED
Go to solution
himacs
Super Advisor

recovering inodes

Hi admins,

how to recover deleted inodes?

i heard that "rm" will only remove inodes not files.Files will be there in disk and new files overwrite that block with new inode.I believe if we recover deleted inode ,we can recover files of that inode.

plz correct me if i wrong and tell me how to recover deleted files/inodes.

regards
himacs
5 REPLIES
James R. Ferguson
Acclaimed Contributor

Re: recovering inodes

Hi Himacs:

Yes, the data will remain on the disk until it is over-written. However, you should consider your file irrecoverable.

Unix does exactly what you tell it to do and turning back isn't one of its options.

Regards!

...JRF...
himacs
Super Advisor

Re: recovering inodes

Hi James,

thanx for ur reply.

So deleted files are not recoverable..?
no such recover tools vailable in unix..

regards
himacs

James R. Ferguson
Acclaimed Contributor

Re: recovering inodes

Hi Himacs:

> So deleted files are not recoverable..?
no such recover tools vailable in unix..

If you delete (remove) a file that is still open (in-use) by a process then you have a better opportunity to recover it, at least in Linux and/or Unix flavors with a '/proc' filesystem. That isn't HP-UX, though.

You might be able to salvage some of the data if your filesystem isn't actively changing by using 'dd' to read the whole filesystem and something like 'grep' to identify potential blocks of data.

Again, you should consider the file lost. But then, you have a backup, don't you?

Regards!

...JRF...
Bill Hassell
Honored Contributor
Solution

Re: recovering inodes

> I believe if we recover deleted inode ,we can recover files of that inode.

You are thinking about Windows filesystems where files aren't deleted at all but simply renamed. Unix inodes are simply a collection of data about space on the disk and then the inode is marked as empty, the details are erased. The data is still on the disk but you would have to examine millions of bytes of data looking for a pattern that you know is in the deleted file. If you don't know what the data contains, the file is not recoverable.

Even if you know the patterns found in your file, you have to immediately shutdown your system to prevent any new files from clobbering your deleted file -- that file is empty space for the filesystem. This is also true for Windows but since these boxes don't often have 50 users and several hundred processes.


Bill Hassell, sysadmin
himacs
Super Advisor

Re: recovering inodes

HI James,BIll

Thanx for the information..

points assigned...



regards
himacs