Retrieve inode for undeleted files

Using TestDisk to undelete files
Post Reply
Message
Author
mrtruji
Posts: 2
Joined: 14 Mar 2013, 22:02

Retrieve inode for undeleted files

#1 Post by mrtruji » 14 Mar 2013, 22:09

Hi,

I have successfully undeleted a large number of text files. In order to identify the file without the filename I will need a reference date for modification, creation, etc. Unfortunately this information is not retained by default by Photorec as evidenced by the 'stat' command run on a file. However, I can recover this date information if I have the corresponding inode (using istat).

Does anyone know how to dump the inode number to the filename or a log when undeleting a file? Is this an option in photorec?

Or

Is it possible to keep a file's metadata (date of access, modification, etc) when undeleting?

Thanks for any advice!

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3461
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Retrieve inode for undeleted files

#2 Post by cgrenier » 30 Mar 2013, 13:41

TestDisk can recover files with their metadata (filenames, creation time) from FAT, NTFS, ext2, exFAT filesystem.
PhotoRec bypasses all file structure and only searches raw data (To be correct, there is an exception for FAT unformat that can be activated in Expert mode)

mrtruji
Posts: 2
Joined: 14 Mar 2013, 22:02

Re: Retrieve inode for undeleted files

#3 Post by mrtruji » 30 Mar 2013, 14:57

Unfortunately, the filesystem I am working with is ext3. Unless I am mistaken, TestDisk cannot recover files with their metadata from this type of filesystem. Is that correct? Thanks!

DSpider
Posts: 23
Joined: 29 Jul 2013, 10:41

Re: Retrieve inode for undeleted files

#4 Post by DSpider » 01 Aug 2013, 09:40

Hi @mrtruji, i have a similar problem, did you resolve it ?

Thank you.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests