Why, when I delete a file in ext4 and then restore it via debugfs, is it not restored in a visible way?

Sequencing:

$ sudo debugfs -w /dev/sda7 debugfs: ls 145312 (12) . 140473 (28) .. 145313 (16) file.one debugfs: rm file.one debugfs: ls 145312 (12) . 140473 (28) .. debugfs: stat <145313> #... dtime: 0x56788cb4 #... debugfs: undel <145313> debugfs: stat <145313> #... (НЕТ dtime, все как обычно) debugfs: ls 145312 (12) . 140473 (28) ..

It turns out that after deleting the inode is listed as deleted, then I restore it, it looks like a regular one, but the file does not appear in the same place. What did I forget?

  • 2
    I never dealt with debugfs, just note that inode and directory entries are two different things. for example, an inode does not store a file name. I suspect that in addition to restoring the inode, it is necessary to recreate the directory entry, which is essentially a reference to the inode. - Mike
  • no, there is a file entry in the directory. if you look at ls -d or something else. and there is an inode, and there is a record, but between them they are not connected ... it is necessary to search. - Jacen Kaedus

1 answer 1

Yes, to really restore the file, you need to make undel <145313> file.restored, and not just undel <145313>, but this does not solve the problem of understanding what exactly is done at the moment of execution of this command. I tried individually all together, it said that: to restore a file, delete the delete time (DTIME), increase the number of links from 0 to 1 (but it almost always remains equal to 1), then I tried to manually set the flag IN-USE for inode, checked the entry in the directory - the entry after deleting the file about it remains (the file name), but after restoring the inode it does not appear in the directory as the corresponding file ... In general, it is not clear.