Hi,
I have successfully undeleted a large number of text files. In order to identify the file without the filename I will need a reference date for modification, creation, etc. Unfortunately this information is not retained by default by Photorec as evidenced by the 'stat' command run on a file. However, I can recover this date information if I have the corresponding inode (using istat).
Does anyone know how to dump the inode number to the filename or a log when undeleting a file? Is this an option in photorec?
Or
Is it possible to keep a file's metadata (date of access, modification, etc) when undeleting?
Thanks for any advice!
Retrieve inode for undeleted files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5439
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: Retrieve inode for undeleted files
TestDisk can recover files with their metadata (filenames, creation time) from FAT, NTFS, ext2, exFAT filesystem.
PhotoRec bypasses all file structure and only searches raw data (To be correct, there is an exception for FAT unformat that can be activated in Expert mode)
PhotoRec bypasses all file structure and only searches raw data (To be correct, there is an exception for FAT unformat that can be activated in Expert mode)
Re: Retrieve inode for undeleted files
Unfortunately, the filesystem I am working with is ext3. Unless I am mistaken, TestDisk cannot recover files with their metadata from this type of filesystem. Is that correct? Thanks!
Re: Retrieve inode for undeleted files
Hi @mrtruji, i have a similar problem, did you resolve it ?
Thank you.
Thank you.