Hal Wine hwine

Recovering deleted files in Ubuntu with ext4 filesystem

Recently, I deleted some files by mistake in a Ubuntu machine with an ext4 fs. These notes document the steps I took to get them back.

Important

this procedure assumes that the partition that contained the deleted files is different from the root partition, as that was the scenario with which I had to deal (deleted files were in my home dir). The procedure needs that the partition that contained the files is unmounted, so if the deleted files were in the root partition, the process would be a bit different (e.g. storing the fs journal in a USB stick, using a live CD/USB to boot and issue the commands, etc.)
if something is not clear, you need more information, etc. check the sources below

With that out the way, let's begin.

Keybase proof

I hereby claim:

I am hwine on github.
I am hwine (https://keybase.io/hwine) on keybase.
I have a public key ASCyt_BuDi5tWeOBnqWjjpu1TK2POdzQFUETpP4OnPU5igo

To claim this, I am signing this object:

Here's an example of how things could work.

Worst case, we don't get back any 'id' when user authenticates via GitHub. So we only have the 'login' name to work with. Note: all queries below are done with my non-privileged account credentials. (Actually, the queries can be made unauthenticated, but the API rate limits are lower.)

At initial authentication time:

Query for details of login. The GraphQL query is:

	1548185906566 mozrunner::runner INFO Running command: "/home/hwine/bin/firefox" "-marionette" "-foreground" "-no-remote" "-profile" "/tmp/rust_mozprofile.9ZNKErSbjZrb"
	1548185906572 geckodriver::marionette DEBUG Waiting 60s to connect to browser on 127.0.0.1:50681
	1548185907136 [email protected] WARN Loading extension '[email protected]': Reading manifest: Invalid host permission: resource://pdf.js/
	1548185907136 [email protected] WARN Loading extension '[email protected]': Reading manifest: Invalid host permission: about:reader*
	1548185907281 Marionette DEBUG Received observer notification profile-after-change
	1548185907368 Marionette DEBUG Received observer notification command-line-startup
	1548185907368 Marionette DEBUG Received observer notification nsPref:changed
	1548185907368 Marionette DEBUG Init aborted (running=false, enabled=true, finalUIStartup=false)
	1548185907561 Marionette DEBUG Received observer notification toplevel-window-ready

	#!/usr/bin/env bash

	# for informational purposes only -- there are no guarantees this format
	# will remain as is.

	for node_id ; do
	echo "${node_id}" \| openssl enc -d -base64
	echo
	done

	"""
	Quick hack to transparently get paginated responses from GitHub
	"""

	import copy # noqa: E402

	class AG_Exception(Exception):
	pass

	================================================================================
	You've found a bug! Please, raise an issue attaching the following traceback
	https://github.com/jorgebastida/awslogs/issues/new
	--------------------------------------------------------------------------------
	Version: 0.10.0
	Python: 2.7.10 (default, Feb 7 2017, 00:08:15)
	[GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.34)]
	boto3 version: 1.4.4
	Platform: Darwin-16.7.0-x86_64-i386-64bit
	Config: {'output_timestamp_enabled': True, 'output_group_enabled': False, 'end': '2017-11-14T15:22+00:00', 'log_group_name': '/aws/lambda/fx-sig-verify-prod', 'log_stream_name': 'ALL', 'aws_region': 'us-east-1', 'watch': False, 'aws_access_key_id': 'SENSITIVE', 'start': '2017-11-13T00:00:00+00:00', 'aws_profile': 'SENSITIVE', 'filter_pattern': None, 'aws_secret_access_key': 'SENSITIVE', 'output_ingestion_time_enabled': False, 'query': None, 'func': 'list_logs', 'aws_session_token': 'SENSITIVE', 'color_enabled': False, 'output_stream_enabled': F

	# pip install jsonstreams
	import jsonstreams

	# example from docs
	mylist = list(range(10))
	mydict = {a: b for a in range(10) for b in 'abcdefghij'}

	# NB - arguement order changed from doc example.
	# see https://github.com/dcbaker/jsonstreams/issues/13
	with jsonstreams.Stream(jsonstreams.Type.object, 'foo') as s:

	"""IPython startup script to detect and inject VIRTUAL_ENV's site-packages dirs.

	IPython can detect virtualenv's path and injects it's site-packages dirs into sys.path.
	But it can go wrong if IPython's python version differs from VIRTUAL_ENV's.

	This module fixes it looking for the actual directories. We use only old stdlib
	resources so it can work with as many Python versions as possible.

	References:
	http://stackoverflow.com/a/30650831/443564

	#!/usr/bin/env python

	stack = []
	matches = {
	# open -> close
	'(': ')',
	'{': '}',
	'[': ']',
	}
	open_chars = matches.keys()