How to recover a deleted file from Linux using debugfs

Home > Search > How-to

In this example, we will assume a file named sample1 was deleted from /home/user1. 

Unmount the home directory, to prevent a new file from being created using the same inode as the sample1 file.

[root@server1 ~]# umount /home


Determine the partition that has the /home directory. In this example, the /home directory is on /dev/sda3.

[root@server1 ~]# df 
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/sda1              1146788     17910    521781   8% /
/dev/sda3             26123452   1271686  24184852  56% /home


Debug the /dev/sda3 file system. This will start the interactive debugfs prompt.

[root@server1 ~]# debugfs /dev/sda3


At the interactive debugfs prompt, type lsdel to list deleted files. Make note of the inodes of the deleted file. In this example, the inodes are 123456 and 789123.

debugfs:  lsdel
Inode  Owner  Mode    Size    Blocks    Time deleted
123456   1000 100600   1234    3/        Mon Jan  1 06:22:15 2016
789123   1000 100600    123    1/        Mon Mar  7 17:34:26 2016
2 deleted inodes found. 


Use the cat command to view the contents of deleted files.

debugfs:cat <123456> 


Use the mi (modify inode) command to restore the file. Change the deletion time to 0 and the link count to 1.

debugfs: mi <123456>


Remount the directory.

[root@server1 ~]# mount /home


List the contents of /home/user1, and the file should now be restored.

[root@server1 ~]# ls -l /home/user1


Add a Comment

We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.

Please enter in the box below so that we can be sure you are a human.