Retrieve inode for undeleted files

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
mrtruji
Posts: 2
Joined: 14 Mar 2013, 22:02

Retrieve inode for undeleted files

#1 Post by mrtruji »

Hi,

I have successfully undeleted a large number of text files. In order to identify the file without the filename I will need a reference date for modification, creation, etc. Unfortunately this information is not retained by default by Photorec as evidenced by the 'stat' command run on a file. However, I can recover this date information if I have the corresponding inode (using istat).

Does anyone know how to dump the inode number to the filename or a log when undeleting a file? Is this an option in photorec?

Or

Is it possible to keep a file's metadata (date of access, modification, etc) when undeleting?

Thanks for any advice!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Retrieve inode for undeleted files

#2 Post by cgrenier »

TestDisk can recover files with their metadata (filenames, creation time) from FAT, NTFS, ext2, exFAT filesystem.
PhotoRec bypasses all file structure and only searches raw data (To be correct, there is an exception for FAT unformat that can be activated in Expert mode)

mrtruji
Posts: 2
Joined: 14 Mar 2013, 22:02

Re: Retrieve inode for undeleted files

#3 Post by mrtruji »

Unfortunately, the filesystem I am working with is ext3. Unless I am mistaken, TestDisk cannot recover files with their metadata from this type of filesystem. Is that correct? Thanks!

DSpider
Posts: 23
Joined: 29 Jul 2013, 10:41

Re: Retrieve inode for undeleted files

#4 Post by DSpider »

Hi @mrtruji, i have a similar problem, did you resolve it ?

Thank you.

Locked