I need to recover a deleted file (no backup available obviously). The
file was
/var/lib/libvirt/images/i5s.raw
As soon as I deleted it, I realized it was the wrong file to delete and
I unplugged the power chord. Then I booted systemrescuecd and mounted
the filesystem readonly.
root@sysresccd /mnt % mkdir /mnt/linux
root@sysresccd /mnt % mount -o ro /dev/mapper/vg0-root /mnt/linux
However the file wasn't there anymore:
root@sysresccd /mnt % ls /mnt/linux/var/lib/libvirt/images/i5s.raw
ls: cannot access /mnt/linux/var/lib/libvirt/images/i5s.raw: No such
file or directory
I unmounted the filesystem and made a block level working copy with dd
onto /dev/md1 (a raid volume I created for the task).
Finally I tried with extundelete:
root@sysresccd /mnt % extundelete --restore-file
var/lib/libvirt/images/i5s.raw -o /mnt/custom/ /dev/md1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 14900 groups loaded.
Loading journal descriptors ... 30765 descriptors loaded.
Unable to restore inode 64618558 (var/lib/libvirt/images/i5s.raw): No
undeleted copies found in the journal.
Unable to restore file var/lib/libvirt/images/i5s.raw
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem
Some questions:
1) Does "Unable to restore inode 64618558" mean that extundelete
actually found my file at that inode, but it cannot recover it for some
other reason?
2) What does "No undeleted copies found in the journal" mean? I guess
that if there where undeleted copies, I'd already had recovered my file,
right?
3) Why am I getting "Operation not permitted"? Can that be the reason
why extundelete cannot recover it? But I'm root...
4) Is there any chance I can recover that file in this situation?
Thanks in advance for any help.
