I have a partition raw image on which I am trying to run extundelete to undelete some files from an ext4 filesystem. Unfortunately extundelete exits with a segmentation fault.

Is there anything I can do?

root@ubuntu-VirtualBox:~# extundelete --restore-all mmcblk0p7.raw 
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
Loading filesystem metadata ... 218 groups loaded.
Loading journal descriptors ... 27292 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Searching for recoverable inodes in directory / ... 
398 recoverable inodes found.
Looking through the directory structure for deleted files ... 
Unable to restore inode 1548814 (lost+found/.Skybox.Cache): No data found.
Segmentation fault (core dumped)

dmesg gives only:

[90218.617232] extundelete[3924]: segfault at 178255 ip b76cd374 sp bfda0d30 error 4 in libext2fs.so.2.4[b76b6000+43000]
  • Does it do the same thing if you do extundelete --restore-file path/to/deleted/file? Though if the file system really is still mounted, your odds of recovering the file are decreasing with each passing minute (e.g. swap, temp, etc, could easily be overwriting the space where the file is . . . ) – ernie Mar 18 '14 at 20:39
  • Seeing this with Kubuntu 12.04. @emie: Not sure about the OP but I saw this with a specific path (not necessarily a specific file). – einpoklum Jun 8 '14 at 15:47

It turns out the ubuntu build has some problems. Building from source helps:

apt-get remove extundelete
apt-get install build-essentials e2fslibs-dev
tar -xjf extundelete-VERSION.tar.bz2
cd extundelete
src/extundelete --restore-all image.raw
  • Thank you, for the question and the answer! You just saved me a lot of anguish... – einpoklum Jun 8 '14 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.