Benjamin_Loison/linux
1
0
Code Issues 84 Packages Projects Wiki

Retrieve recently deleted files in a given folder #79

New Issue
Open
opened 2025-05-20 01:43:49 +02:00 by Benjamin_Loison · 7 comments
Benjamin_Loison commented 2025-05-20 01:43:49 +02:00
Owner
Copy Link

The Stack Overflow answer 31884665 may help.

Related to #22 and Benjamin_Loison/shred/issues/15.

[The Stack Overflow answer 31884665](https://stackoverflow.com/a/31884665) may help. Related to #22 and [Benjamin_Loison/shred/issues/15](https://codeberg.org/Benjamin_Loison/shred/issues/15).
Benjamin_Loison commented 2025-05-20 01:45:58 +02:00
Author
Owner
Copy Link

On my Linux Mint 22.1 Cinnamon Framework 13 for home folder that is encrypted in addition to the disk:

sudo fdisk -l
Output: 
Disk /dev/nvme0n1: 1.82 TiB, 2000398934016 bytes, 3907029168 sectors
Disk model: WD_BLACK SN850X 2000GB                  
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Device           Start        End    Sectors  Size Type
/dev/nvme0n1p1    2048    1050623    1048576  512M EFI System
/dev/nvme0n1p2 1050624    4550655    3500032  1.7G Linux filesystem
/dev/nvme0n1p3 4550656 3907028991 3902478336  1.8T Linux filesystem


Disk /dev/mapper/nvme0n1p3_crypt: 1.82 TiB, 1998052130816 bytes, 3902445568 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/vgmint-root: 1.82 TiB, 1997025574912 bytes, 3900440576 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/vgmint-swap_1: 976 MiB, 1023410176 bytes, 1998848 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
On my Linux Mint 22.1 Cinnamon Framework 13 for home folder that is encrypted in addition to the disk: ```bash sudo fdisk -l ``` <details> <summary>Output:</summary> ``` Disk /dev/nvme0n1: 1.82 TiB, 2000398934016 bytes, 3907029168 sectors Disk model: WD_BLACK SN850X 2000GB Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX Device Start End Sectors Size Type /dev/nvme0n1p1 2048 1050623 1048576 512M EFI System /dev/nvme0n1p2 1050624 4550655 3500032 1.7G Linux filesystem /dev/nvme0n1p3 4550656 3907028991 3902478336 1.8T Linux filesystem Disk /dev/mapper/nvme0n1p3_crypt: 1.82 TiB, 1998052130816 bytes, 3902445568 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/mapper/vgmint-root: 1.82 TiB, 1997025574912 bytes, 3900440576 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/mapper/vgmint-swap_1: 976 MiB, 1023410176 bytes, 1998848 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes ``` </details>
Benjamin_Loison commented 2025-05-20 01:46:47 +02:00
Author
Owner
Copy Link
sudo debugfs /dev/nvme0n1
Output: 
debugfs 1.47.0 (5-Feb-2023)
debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1
Found a gpt partition table in /dev/nvme0n1
debugfs:

Related to Benjamin_Loison/e2fsprogs/issues/1.

sudo debugfs /dev/nvme0n1p3
Output: 
debugfs 1.47.0 (5-Feb-2023)
debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1p3
/dev/nvme0n1p3 contains a crypto_LUKS file system
debugfs:

Could try on an unencrypted ext4 first.

```bash sudo debugfs /dev/nvme0n1 ``` <details> <summary>Output:</summary> ``` debugfs 1.47.0 (5-Feb-2023) debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1 Found a gpt partition table in /dev/nvme0n1 debugfs: ``` </details> Related to [Benjamin_Loison/e2fsprogs/issues/1](https://codeberg.org/Benjamin_Loison/e2fsprogs/issues/1). ```bash sudo debugfs /dev/nvme0n1p3 ``` <details> <summary>Output:</summary> ``` debugfs 1.47.0 (5-Feb-2023) debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1p3 /dev/nvme0n1p3 contains a crypto_LUKS file system debugfs: ``` </details> Could try on an unencrypted ext4 first.
Benjamin_Loison commented 2025-05-20 01:50:37 +02:00
Author
Owner
Copy Link
sudo debugfs /dev/mapper/vgmint-root
Output: 
debugfs 1.47.0 (5-Feb-2023)
debugfs:  lsdel
ls_deleted_inodes: Extent block checksum does not match extent block while calling ext2fs_block_iterate2
```bash sudo debugfs /dev/mapper/vgmint-root ``` <details> <summary>Output:</summary> ``` debugfs 1.47.0 (5-Feb-2023) debugfs: lsdel ls_deleted_inodes: Extent block checksum does not match extent block while calling ext2fs_block_iterate2 ``` </details>
Benjamin_Loison commented 2025-05-20 01:51:10 +02:00
Author
Owner
Copy Link
Output: 
 Inode  Owner  Mode    Size      Blocks   Time deleted
91963533   1000  40775   4096      1/     1 Fri Oct 13 08:09:18 2023
93266250   1000  40775   4096      1/     1 Fri Oct 13 08:09:18 2023
95518949   1000  40775   4096      1/     1 Thu Nov  9 00:39:32 2023
95608995   1000  40775   4096      1/     1 Thu Nov  9 00:39:32 2023
95674711   1000  40775   4096      1/     1 Thu Nov  9 00:39:32 2023
92512504   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
92594419   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
102580503   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
102588692   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
93479933   1000  40775   4096      1/     1 Sun Apr 28 01:13:00 2024
101335251   1000  40775   4096      1/     1 Sun Apr 28 01:13:00 2024
94381939   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94382443   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94383508   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94384790   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94385431   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94385442   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94397562   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94513615   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94513617   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94513640   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94528023   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94528059   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
91586565   1000  40775  12288      1/     3 Mon Mar 24 20:13:28 2025
91603164   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
91668761   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
91717661   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
96968810   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
96968828   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
91947232   1000  40755   4096      1/     1 Sun Apr 20 19:38:41 2025
95436979   1000  40775   4096      1/     1 Sat May 10 13:13:00 2025
98689049   1000  40775   4096      1/     1 Sat May 10 13:13:00 2025
98689069   1000  40775   4096      1/     1 Sat May 10 13:13:00 2025
33 deleted inodes found.
<details> <summary>Output:</summary> ``` Inode Owner Mode Size Blocks Time deleted 91963533 1000 40775 4096 1/ 1 Fri Oct 13 08:09:18 2023 93266250 1000 40775 4096 1/ 1 Fri Oct 13 08:09:18 2023 95518949 1000 40775 4096 1/ 1 Thu Nov 9 00:39:32 2023 95608995 1000 40775 4096 1/ 1 Thu Nov 9 00:39:32 2023 95674711 1000 40775 4096 1/ 1 Thu Nov 9 00:39:32 2023 92512504 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 92594419 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 102580503 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 102588692 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 93479933 1000 40775 4096 1/ 1 Sun Apr 28 01:13:00 2024 101335251 1000 40775 4096 1/ 1 Sun Apr 28 01:13:00 2024 94381939 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94382443 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94383508 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94384790 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94385431 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94385442 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94397562 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94513615 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94513617 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94513640 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94528023 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94528059 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 91586565 1000 40775 12288 1/ 3 Mon Mar 24 20:13:28 2025 91603164 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 91668761 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 91717661 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 96968810 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 96968828 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 91947232 1000 40755 4096 1/ 1 Sun Apr 20 19:38:41 2025 95436979 1000 40775 4096 1/ 1 Sat May 10 13:13:00 2025 98689049 1000 40775 4096 1/ 1 Sat May 10 13:13:00 2025 98689069 1000 40775 4096 1/ 1 Sat May 10 13:13:00 2025 33 deleted inodes found. ``` </details>
Benjamin_Loison commented 2025-05-20 01:51:58 +02:00
Author
Owner
Copy Link

It seems chronologically ordered.

It seems chronologically ordered.
Benjamin_Loison commented 2025-05-20 01:52:34 +02:00
Author
Owner
Copy Link

I quite don't get why still able to easily list deleted files, there are still metadata tracking them on the disk?

I quite don't get why still able to easily list deleted files, there are still metadata tracking them on the disk?
Benjamin_Loison commented 2025-05-20 01:53:29 +02:00
Author
Owner
Copy Link

It does not list files I just rm. Maybe because I continued using the SSD without even explictly using it.

It does not list files I just `rm`. Maybe because I continued using the SSD without even explictly using it.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Benjamin_Loison
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Benjamin_Loison/linux#79
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?