How To Undelete Files Using debugfs in Linux

Have you accidentally deleted important files on your Linux system and looking for a way to recover them? Look no further, as this guide will show you how to use debugfs to recover deleted files in Linux. The debugfs tool allows users to access a file system's inode information and data structures, making it a powerful tool for file recovery.

Part 1. What Is debugfs?

Debugfs is a powerful debugging utility in the Linux operating system that provides a way to access a file system's internal data structures and inode information. Kernel developers often use it to perform tasks such as file undeletion and data recovery.

Debugfs has some features that make it a helpful tool for managing file systems. It provides a simple, RAM-based interface for accessing file system information and allows users to manipulate inode data structures and perform file undeletion. Debugfs also offers many other functions, such as displaying file system statistics and more. 

Part 2. How To Use debugfs

In the Linux Kernel environment, debugfs is a widely adopted file system for drivers and subsystems. Unlike other file systems, the contents of debugfs files are generated by the kernel and are specific to each driver or subsystem. When developing new drivers, debugfs are favored over printk statements as it provides a more streamlined process for enabling/disabling and a standardized interface.

Prerequisites

Suppose the kernel is built with the following configuration options:

CONFIG_DEBUG_FS=y

Mounting debugfs

The process is similar to other virtual file systems using the mount command. For mounting the debugfs filesystem:

Step 1: Create a mount point. The default is /sys/kernel/debug/; it may be present already.

# mkdir /sys/kernel/debug

Step 2: Mount debugfs using the mount command:

# mount -t debugfs none /sys/kernel/debug

Step 3: Utilize the cat command to view the contents of the file system:

# cat /sys/kernel/debug/gpio
GPIOs 32-63, A:
[ds5] GPIOA6: [gpio] set
[ds1] GPIOA9: [gpio] clear
[sda] GPIOA23: [gpio] set
[scl] GPIOA24: [gpio] set
[Button 3] GPIOA30: [gpio] set
[Button 4] GPIOA31: [gpio] set

GPIOs 64-95, B:

GPIOs 96-127, C:
[udc_vbus] GPIOC5: [gpio] set
[nand_rdy] GPIOC13: [gpio] set
[nand_enable] GPIOC14: [gpio] set

Adding debugfs Support to a Driver

The debugfs API can be found in the kernel source files, fs/debugfs/inode.c and fs/debugfs/file.c. To create debugfs files for a driver or subsystem, follow these three steps:

Part 3. How To Recover Deleted Files Using debugfs in Linux?

The process is straightforward.

Step 1: Create a text file (data.txt) and enter:

echo 'This is a test' > data.txt

Step 2: To display the inode number of data.txt, enter the command:

ls -li data.txt

Step 3: It provides an output. Here's a sample:

7536648 -rw-r--r-- 1 root root 15 May 3 12:40 data.txt

Note the inode number.

Step 4: Suppose the file system is on /dev/sda2, enter the command

# debugfs -w /dev/sda2

OR

If the file system is /dev/mapper/wks01-root, type the command:

# debugfs -w /dev/mapper/wks01-root

After a while, you will receive the following prompt:

debugfs 1.41.12 (17-May-2010)
debugfs:

Type the command below to get block of data

debugfs: logdump -i <7536648>

You will again receive an output. Note down the blocks. E.g. (0+1): 7559168 line

Step 5. Use the following command to remove data.txt file

rm data.txt
ls data.txt

You will receive output such as under

ls: cannot access data.txt: No such file or directory.

Step 6: To recover the file, type the following command:

# dd if=/dev/mapper/wks01-root of=data.txt bs=4096 count=1 skip=7559168

Step 7: Confirm that the data is recovered.

cat data.txt

Finally, you will receive an output such as:

This is a test

Part 4. The Best Alternative to debugfs for Recovering Deleted Files From Linux

Debugfs is a powerful tool in the Linux environment; however, it does have some limitations that need to be considered while deciding whether to use it for a given task. First, its primary purpose is for debugging, and it may not be suitable for all use cases.

Also, the functionality of debugfs can be complex and challenging for users with limited technical knowledge to understand. Nevertheless, you can try Wondesrshare Recoverit Linux Recovery tool as it is easy to use and possesses several data recovery features, such as:

Wondershare Recoverit - Your Safe and Reliable Linux Recovery Software

Try It Free Try It Free

5,481,435 people have downloaded it.

Recovers lost or deleted documents, photos, videos, music, emails, and other 1000+ file types effectively, safely, and completely.

Compatible with all mainstream Linux distros, including Ubuntu, Linux Mint, Debian, Fedora, Solus, Opensuse, Manjaro, etc.

Assists in 500+ data loss scenarios, such as deletion, disk formatting, power outage, virus attack, lost partition, and many more.

Works through a remote connection. You can get data back even when your Linux computer is crashed.

To use this debugfs alternative to recover deleted files, follow these steps:

Step 1: Launch the Linux data recovery tool after installation and navigate to the NAS and Linux option on the left-hand side of the main interface. From there, click the Linux Recovery button to begin the data recovery process.

Step 2: A new window will appear, requiring you to input the necessary information for remote connection. After completing the information, initiate the connection by clicking the Connect button.

Step 3: Upon a successful connection, Recoverit will initiate an automated scan to search for any missing files on the Linux device. Once the desired file is located, the scan can be stopped and the file restored.

Step 4: Once the scan completes, preview the files to ensure they are the desired ones for recovery. Then, press the Recover button to save the files.

The debugfs alternative software will prompt you to select the destination folder to save your recovered files. Initiate the recovery process by clicking the Recover button. For best practices, it is suggested to choose a different location than the original one to save the recovered files.

Conclusion

When it comes to recovering deleted files in Linux, debugfs offers a powerful solution for experienced users. Still, for those seeking a more accessible option, Wondershare Recoverit Linux Recovery is a great choice. It simplifies the recovery process and ensures successful results, making it a reliable solution for data loss.