Benjamin_Loison/linux
1
0
Code Issues 95 Packages Projects Wiki

Retrieve recently deleted files in a given folder #79

New Issue
Open
opened 2025-05-20 01:43:49 +02:00 by Benjamin_Loison · 9 comments
Benjamin_Loison commented 2025-05-20 01:43:49 +02:00
Owner
Copy Link
Copy Source

The Stack Overflow answer 31884665 may help.

Related to #22 and Benjamin_Loison/shred/issues/15.

[The Stack Overflow answer 31884665](https://stackoverflow.com/a/31884665) may help. Related to #22 and [Benjamin_Loison/shred/issues/15](https://codeberg.org/Benjamin_Loison/shred/issues/15).
Benjamin_Loison commented 2025-05-20 01:45:58 +02:00
Author
Owner
Copy Link
Copy Source

On my Linux Mint 22.1 Cinnamon Framework 13 for home folder that is encrypted in addition to the disk:

sudo fdisk -l
Output: 
Disk /dev/nvme0n1: 1.82 TiB, 2000398934016 bytes, 3907029168 sectors
Disk model: WD_BLACK SN850X 2000GB                  
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Device           Start        End    Sectors  Size Type
/dev/nvme0n1p1    2048    1050623    1048576  512M EFI System
/dev/nvme0n1p2 1050624    4550655    3500032  1.7G Linux filesystem
/dev/nvme0n1p3 4550656 3907028991 3902478336  1.8T Linux filesystem


Disk /dev/mapper/nvme0n1p3_crypt: 1.82 TiB, 1998052130816 bytes, 3902445568 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/vgmint-root: 1.82 TiB, 1997025574912 bytes, 3900440576 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mapper/vgmint-swap_1: 976 MiB, 1023410176 bytes, 1998848 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
On my Linux Mint 22.1 Cinnamon Framework 13 for home folder that is encrypted in addition to the disk: ```bash sudo fdisk -l ``` <details> <summary>Output:</summary> ``` Disk /dev/nvme0n1: 1.82 TiB, 2000398934016 bytes, 3907029168 sectors Disk model: WD_BLACK SN850X 2000GB Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt Disk identifier: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX Device Start End Sectors Size Type /dev/nvme0n1p1 2048 1050623 1048576 512M EFI System /dev/nvme0n1p2 1050624 4550655 3500032 1.7G Linux filesystem /dev/nvme0n1p3 4550656 3907028991 3902478336 1.8T Linux filesystem Disk /dev/mapper/nvme0n1p3_crypt: 1.82 TiB, 1998052130816 bytes, 3902445568 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/mapper/vgmint-root: 1.82 TiB, 1997025574912 bytes, 3900440576 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disk /dev/mapper/vgmint-swap_1: 976 MiB, 1023410176 bytes, 1998848 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes ``` </details>
Benjamin_Loison commented 2025-05-20 01:46:47 +02:00
Author
Owner
Copy Link
Copy Source
sudo debugfs /dev/nvme0n1
Output: 
debugfs 1.47.0 (5-Feb-2023)
debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1
Found a gpt partition table in /dev/nvme0n1
debugfs:

Related to Benjamin_Loison/e2fsprogs/issues/1.

sudo debugfs /dev/nvme0n1p3
Output: 
debugfs 1.47.0 (5-Feb-2023)
debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1p3
/dev/nvme0n1p3 contains a crypto_LUKS file system
debugfs:

Could try on an unencrypted ext4 first.

```bash sudo debugfs /dev/nvme0n1 ``` <details> <summary>Output:</summary> ``` debugfs 1.47.0 (5-Feb-2023) debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1 Found a gpt partition table in /dev/nvme0n1 debugfs: ``` </details> Related to [Benjamin_Loison/e2fsprogs/issues/1](https://codeberg.org/Benjamin_Loison/e2fsprogs/issues/1). ```bash sudo debugfs /dev/nvme0n1p3 ``` <details> <summary>Output:</summary> ``` debugfs 1.47.0 (5-Feb-2023) debugfs: Bad magic number in super-block while trying to open /dev/nvme0n1p3 /dev/nvme0n1p3 contains a crypto_LUKS file system debugfs: ``` </details> Could try on an unencrypted ext4 first.
Benjamin_Loison commented 2025-05-20 01:50:37 +02:00
Author
Owner
Copy Link
Copy Source
sudo debugfs /dev/mapper/vgmint-root
Output: 
debugfs 1.47.0 (5-Feb-2023)
debugfs:  lsdel
ls_deleted_inodes: Extent block checksum does not match extent block while calling ext2fs_block_iterate2
```bash sudo debugfs /dev/mapper/vgmint-root ``` <details> <summary>Output:</summary> ``` debugfs 1.47.0 (5-Feb-2023) debugfs: lsdel ls_deleted_inodes: Extent block checksum does not match extent block while calling ext2fs_block_iterate2 ``` </details>
Benjamin_Loison commented 2025-05-20 01:51:10 +02:00
Author
Owner
Copy Link
Copy Source
Output: 
 Inode  Owner  Mode    Size      Blocks   Time deleted
91963533   1000  40775   4096      1/     1 Fri Oct 13 08:09:18 2023
93266250   1000  40775   4096      1/     1 Fri Oct 13 08:09:18 2023
95518949   1000  40775   4096      1/     1 Thu Nov  9 00:39:32 2023
95608995   1000  40775   4096      1/     1 Thu Nov  9 00:39:32 2023
95674711   1000  40775   4096      1/     1 Thu Nov  9 00:39:32 2023
92512504   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
92594419   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
102580503   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
102588692   1000  40775   4096      1/     1 Sun Mar 31 19:23:38 2024
93479933   1000  40775   4096      1/     1 Sun Apr 28 01:13:00 2024
101335251   1000  40775   4096      1/     1 Sun Apr 28 01:13:00 2024
94381939   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94382443   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94383508   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94384790   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94385431   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94385442   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94397562   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94513615   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94513617   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94513640   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94528023   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
94528059   1000  40775   4096      1/     1 Tue Jun 11 22:11:37 2024
91586565   1000  40775  12288      1/     3 Mon Mar 24 20:13:28 2025
91603164   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
91668761   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
91717661   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
96968810   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
96968828   1000  40775   4096      1/     1 Mon Mar 24 20:13:28 2025
91947232   1000  40755   4096      1/     1 Sun Apr 20 19:38:41 2025
95436979   1000  40775   4096      1/     1 Sat May 10 13:13:00 2025
98689049   1000  40775   4096      1/     1 Sat May 10 13:13:00 2025
98689069   1000  40775   4096      1/     1 Sat May 10 13:13:00 2025
33 deleted inodes found.

does not mentions a file I just rm.

<details> <summary>Output:</summary> ``` Inode Owner Mode Size Blocks Time deleted 91963533 1000 40775 4096 1/ 1 Fri Oct 13 08:09:18 2023 93266250 1000 40775 4096 1/ 1 Fri Oct 13 08:09:18 2023 95518949 1000 40775 4096 1/ 1 Thu Nov 9 00:39:32 2023 95608995 1000 40775 4096 1/ 1 Thu Nov 9 00:39:32 2023 95674711 1000 40775 4096 1/ 1 Thu Nov 9 00:39:32 2023 92512504 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 92594419 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 102580503 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 102588692 1000 40775 4096 1/ 1 Sun Mar 31 19:23:38 2024 93479933 1000 40775 4096 1/ 1 Sun Apr 28 01:13:00 2024 101335251 1000 40775 4096 1/ 1 Sun Apr 28 01:13:00 2024 94381939 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94382443 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94383508 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94384790 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94385431 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94385442 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94397562 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94513615 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94513617 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94513640 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94528023 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 94528059 1000 40775 4096 1/ 1 Tue Jun 11 22:11:37 2024 91586565 1000 40775 12288 1/ 3 Mon Mar 24 20:13:28 2025 91603164 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 91668761 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 91717661 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 96968810 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 96968828 1000 40775 4096 1/ 1 Mon Mar 24 20:13:28 2025 91947232 1000 40755 4096 1/ 1 Sun Apr 20 19:38:41 2025 95436979 1000 40775 4096 1/ 1 Sat May 10 13:13:00 2025 98689049 1000 40775 4096 1/ 1 Sat May 10 13:13:00 2025 98689069 1000 40775 4096 1/ 1 Sat May 10 13:13:00 2025 33 deleted inodes found. ``` </details> does not mentions a file I just `rm`.
Benjamin_Loison commented 2025-05-20 01:51:58 +02:00
Author
Owner
Copy Link
Copy Source

It seems chronologically ordered.

It seems chronologically ordered.
Benjamin_Loison commented 2025-05-20 01:52:34 +02:00
Author
Owner
Copy Link
Copy Source

I quite don't get why still able to easily list deleted files, there are still metadata tracking them on the disk?

I quite don't get why still able to easily list deleted files, there are still metadata tracking them on the disk?
Benjamin_Loison commented 2025-05-20 01:53:29 +02:00
Author
Owner
Copy Link
Copy Source

It does not list files I just rm. Maybe because I continued using the SSD without even explictly using it.

It does not list files I just `rm`. Maybe because I continued using the SSD without even explictly using it.
Benjamin_Loison commented 2026-03-21 00:42:52 +01:00
Author
Owner
Copy Link
Copy Source

On Debian 13 unencrypted OverClock3000:

sudo fdisk -l
Output: 
Disk /dev/vda: 238.47 GiB, 256060514304 bytes, 500118192 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xXXXXXXXX

Device     Boot Start       End   Sectors   Size Id Type
/dev/vda1  *     2048 500117503 500115456 238.5G 83 Linux
On Debian 13 unencrypted OverClock3000: ```bash sudo fdisk -l ``` <details> <summary>Output:</summary> ``` Disk /dev/vda: 238.47 GiB, 256060514304 bytes, 500118192 sectors Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0xXXXXXXXX Device Boot Start End Sectors Size Id Type /dev/vda1 * 2048 500117503 500115456 238.5G 83 Linux ``` </details>
Benjamin_Loison commented 2026-03-21 00:44:03 +01:00
Author
Owner
Copy Link
Copy Source

Using /dev/vda1:

Output: 
 Inode  Owner  Mode    Size      Blocks   Time deleted
12202589   1000 100644  14184      4/     4 Sun Feb 22 17:55:27 2026
12202759   1000 100600    348      1/     1 Sun Feb 22 17:55:27 2026
12202805   1000 100600   1276      1/     1 Sun Feb 22 17:55:27 2026
12233747   1000 100664  32768      8/     8 Sun Feb 22 17:55:27 2026
12234919   1000 100664  32768      8/     8 Sun Feb 22 17:55:27 2026
12235164   1000 100644  14184      4/     4 Sun Feb 22 17:55:27 2026
12235184   1000 100644  13822      4/     4 Sun Feb 22 17:55:27 2026
12235188   1000 100644  14194      4/     4 Sun Feb 22 17:55:27 2026
12235191   1000 100644  14184      4/     4 Sun Feb 22 17:55:27 2026
12235198   1000 100644  14184      4/     4 Sun Feb 22 17:55:27 2026
13392886      0 100755 13299504    381/  3248 Sun Feb 22 17:55:27 2026
13394643      0 100755 6454008    228/  1576 Sun Feb 22 17:55:27 2026
12235187   1000 100600    348      1/     1 Fri Mar 13 18:19:46 2026
12235189   1000 100664  32768      8/     8 Fri Mar 13 18:19:46 2026
14 deleted inodes found.

still does not mention just rm file, created with echo a > b.

Using `/dev/vda1`: <details> <summary>Output:</summary> ``` Inode Owner Mode Size Blocks Time deleted 12202589 1000 100644 14184 4/ 4 Sun Feb 22 17:55:27 2026 12202759 1000 100600 348 1/ 1 Sun Feb 22 17:55:27 2026 12202805 1000 100600 1276 1/ 1 Sun Feb 22 17:55:27 2026 12233747 1000 100664 32768 8/ 8 Sun Feb 22 17:55:27 2026 12234919 1000 100664 32768 8/ 8 Sun Feb 22 17:55:27 2026 12235164 1000 100644 14184 4/ 4 Sun Feb 22 17:55:27 2026 12235184 1000 100644 13822 4/ 4 Sun Feb 22 17:55:27 2026 12235188 1000 100644 14194 4/ 4 Sun Feb 22 17:55:27 2026 12235191 1000 100644 14184 4/ 4 Sun Feb 22 17:55:27 2026 12235198 1000 100644 14184 4/ 4 Sun Feb 22 17:55:27 2026 13392886 0 100755 13299504 381/ 3248 Sun Feb 22 17:55:27 2026 13394643 0 100755 6454008 228/ 1576 Sun Feb 22 17:55:27 2026 12235187 1000 100600 348 1/ 1 Fri Mar 13 18:19:46 2026 12235189 1000 100664 32768 8/ 8 Fri Mar 13 18:19:46 2026 14 deleted inodes found. ``` </details> still does not mention just `rm` file, created with `echo a > b`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Loison (Benjamin Loison)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Benjamin_Loison/linux#79