Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do I undelete (recover) a deleted file on a btrfs partition?

I have not taken a snapshot yet, so I can't use that feature. I know there are some tools for other Linux file systems, but google has not turned up anything specific to btrfs. I came across one vague mention that btrfs includes an undelete tool, but I can't find it. Before trying tools for another file system, I'm asking here.

More info:

  • The (two) deleted files were deleted by a remote rsync command gone wrong.
  • These were small plain text files.
  • I know the names of the files.
  • I might be able to remember some strings in the files.
  • The disk is a regular HDD, but it is large (2TB).
  • I'm running Kubuntu 12.04 (beta2) with all latest updates.
  • I have not written any new data to the partition the files were deleted from.
  • I don't have a snapshot or a backup of these files. (The last backup is just a few hours older than these files.)
  • Strangely, a COW file system seems to have fewer file undelete options than ext3/4...
share|improve this question

2 Answers 2

up vote 1 down vote accepted

As your files are small and plain text, I would try scanning the output of "strings" into the device where the filesystem resides, ie,

strings /dev/sda1 | less

then use "/" to search for the strings that could be in that file. When you find the text, delimit the start of it with "m" then move to the end and use "|cat >file" to save it to a file.

I've actually done that when I had a similar situation on another filesystem without undelete, a few years back, and it worked great for me.

share|improve this answer

Jörg Walter implemented a btrfs-undelete shell script using the find-root and restore tools from btrfs-progs, which can be found here, and should help others in a similar position.

As it is licensed under GPLv2, I cannot include it here.

share|improve this answer
    
Worth noting is that the said script has at least one path hardcoded (presumably by mistake) and has a few other problems, so buyers beware that it must be edited before use. –  gamen Jul 15 at 6:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.