Everyone suffers from clouded judgement from time to time; thankfully, there are tools that exist that may help correct your fat-fingered mistakes. Suffice to say, I had to delve into this subject recently and I thought I would share my method of recovering some important files from a ReiserFS partition.

If you or a user have mistakenly deleted or moved files from a filesystem, all is not lost. Most distributions of Linux that support ReiserFS ship with a couple of tools that can be used to recreate the filesystem if the data is still intact on the device. I will be discussing reiserfsck and a couple of more generic disk tools in this post.

First and foremost, it is important to unmount the partition as soon as you have discovered the mistaken deletion! Stop using it. While data is not wiped from the drive in a deletion, unlink, or move operation, the area of the disk which the deleted file occupied is marked as available. If you continue working with the filesystem after having deleted the file, chances are very good that the freed space will be used, destroying the file you want to recover!

The second rule of data recovery is to always make a backup of the affected partition. If for some reason the filesystem check makes matters worse, you can revert to the previous state. This is important, but sometimes difficult if working with large disks or partitions. Trust me, you will want to make sure you have that backup. If reiserfsck is unable to correct the problem, you may want to try another approach later. Having a backup of the partition is paramount in this situation.

Let's begin with that disk image. The dd utility can be used to make a backup of a partition or a whole disk. Remember to specify block size when you make your copy, or you will be waiting a long time for it to complete. This example assumes your affected partition is /dev/sde1 and you have enough space in /data to hold the image. You must unmount the partition if you have not already before continuing.


# dd if=/dev/sde1 of=/data/sde1-backup.img bs=16M


Now that we have a bit-for-bit backup available of the damaged ReiserFS partition, we can begin working.

This method employs the reiserfsck utility to scan the entire partition and rebuild the filesystem tree from data that is encountered. This is a big, sweeping rewrite of the partition which will recover as many whole files as possible. In my particular case, this is what I wanted -- I was after a few complete directories that had been wrongfully deleted. Depending on how quickly you caught the deletion and began this process, you may or may not recover everything in its normal location. Files that are recovered but were unable to be renamed correctly will be placed in lost+found. They will be given numeric names which loosely correspond to their locations in the filesystem. Files that have the same first few numbers were likely in the same directory together.

This invocation of reiserfsck will perform the operation described above:


# reiserfsck --rebuild-tree -S /dev/sde1


You will be required to enter 'Yes' at this point to continue. Since we have made a backup of the partition using dd previously, there is no need to worry about what will happen here. Should something go wrong, we still have the original image of the filesystem to revert to if needed.

Depending on the size of your partition, this operation may take a long time. When it returns, reiserfsck will output a summary of what was done -- how many files, directories, links, etc were recovered will be listed.

Now, hold your breath, mount the partition, and take a look around. If you are lucky, your files will be accessible in their original locations. If not, you will need to dig through lost+found and try to identify the numerically named files that were recovered. The file utility can make this a bit simpler to quickly identify files without having to open them individually.

Be careful, and good luck!