Undeleting in Linux

På Norsk

I accidentially deleted a lot of files from a memory card (xd-card, but the type shouldn’t matter). As I am only running Linux at home, the commersial solutions for windows that turned up on google were not usable, but the soulution turned out already to be there, just under my desktop, fsck.vfat:

carex:/home/morten# fsck.vfat -r -y -u /dcim/100_fuji/dscf2389.jpg /dev/sda1
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Undeleting DSCF2389.JPG
Performing changes.
/dev/sda1: 69 files, 3343/15994 clusters

Luckily, I knew a file name. I started off with the last file, and worked backwards until fsck.vfat didn’t yield any more files. As I lost my cound, I managed to try to unerase some files twice, which truncated the file to 0 bytes, but the file showed up at the root of the file system:

[morten@carex ~]$ ls -l /mnt/cam/fsck000*
-rwxr-xr-x  1 morten morten 868352 1979-12-31 23:00 /mnt/cam/fsck0000.rec
-rwxr-xr-x  1 morten morten 868352 1979-12-31 23:00 /mnt/cam/fsck0001.rec
-rwxr-xr-x  1 morten morten 851968 1979-12-31 23:00 /mnt/cam/fsck0002.rec

Three mvs later everyting was OK.

This job looked quite scriptable, but for some reason, that did not work:

carex:/home/morten# for i in 9 8 7 6 5 4 3 2 1 0; do 
>fsck.vfat -y -r -u /mnt/cam/dcim/100_fuji/dscf242$i.jpg /dev/sda1
>done
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Warning: did not undelete file DSCF2429.JPG
/dev/sda1: 27 files, 1303/15994 clusters
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Warning: did not undelete file DSCF2428.JPG
/dev/sda1: 27 files, 1303/15994 clusters

Of cource, all this has to be done as root

Hope this can help somebody else aswell. At least, it saved my marriage as the pictures were taken by my wife in her job…