Using the find function and the delete option I deleted all the files in my 140gb partition

I do not have enough free space to restore the file using programs like photoRec which I have ran but the output put was files that were corrupted.

I have searched google and forums and have found out how to use debugfs. Running it on my unmounted partition I can see the deleted directories and files with ls -d. Running lsdel shows no files. I can also run stat on the deleted inode and it prints the details about the inode.

Does anyone know how to restore these inodes 'in place' effectively creating a link to the files again without destroying the data and without having to copy it to another drive/partition?

Debugfs has an undel flag but I don't really know what I'm doing with it. Also read that I have to run it with e2fsck. Is this possible without loosing the rest of my files?

Are we to assume ext[234] ?
First things first - take a (dd) backup. Disk is cheap; go buy another in need.

Have you read this ?. There is a later utility extundelete. I haven't tested it yet.

the partition is ext4 (i was mean to put that in my first post). after doing my searching makes the process a little more difficult.

As i am a student it is not possible for me to buy another hdd. I am considering deleting some other files that are not as important to free up enough space to create an image.

Yes i had flicked over the first page that posted and will have another read in more detail, thanks. I had checked out the extundelete utility before posting however everyone has said that they have not tested it. I ran into the following problem when running make:

make -s all-recursive
Making all in src
extundelete.cc: In function ‘int load_super_block(struct_ext2_filsys*)’:
extundelete.cc:944:47: error: invalid use of incomplete type ‘struct opaque_ext2_group_desc’
/usr/include/ext2fs/ext2fs.h:211:8: error: forward declaration of ‘struct opaque_ext2_group_desc’
extundelete.cc:944:47: error: no match for ‘operator=’ in ‘*(group_descriptor_table + ((unsigned int)(n * 32u))) = * fs->struct_ext2_filsys::group_desc’
/usr/include/ext2fs/ext2_fs.h:137:1: note: candidate is: ext2_group_desc& ext2_group_desc:perator=(const ext2_group_desc&)
make[2]: *** [extundelete-extundelete.o] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

I can try to figure out some problems, but this looked to big for me to debug and so i decided to give up on this utility (unless it is easy fix?).

Do you have all the pre-reqs mentioned ?. Principally e2fslibs-dev I would imagine.
I see several positive posts on the web - looks good actually. If I get bored over the weekend I'll pull it down for a quick run.

thanks for your reply. yes i did make sure that i have all of them installed. from my understanding there were two requirements e2fslibs and e2fsprogs, as well as the development version of each. I installed e2fslibs-dev assuming that was the development version. e2fsprogs did not have a dev option and i could not seam to find the development version only e2fsprogs-dbg which is debugging? I installed it anyway. I did all this before trying to install extundelete and then getting the output listed above

So I played around and did a bit of further searching on extundelete and managed to install it using apt-get (not sure why this did work the first time installed it).

The downside is that it does not appear to be successful in recovering the files. When running using option --restore-all nothing happens, both on the partition and there are no files restored to its default directory (RECOVER_FILES).

I did run --restore-inode and gave it an inode (the inode was a directory). Noting happend and now I can not see that inode listed when running ls -d in debugfs. Also I can't see the inode that I gave it anywhere. I have a saved txt file of the output of ls -d from debugfs.

Okay, I just had a play. Did everything you did, including the "find ... -delete"
Have a look for the RECOVERY_FILES in the working directory of the user you used to run the extundelete command - not on the subject disk/partition. Worked fine for me (Fedora 15).

Ok so i had another go as you said. This time it printed Out saying that it was unable to restore inode, the inode number and then the name of the directory then : No Data. There was data in this directory prior to the delete. A
So after looking in the recovered_FILES dir there was nothing.

Running debugfs I can still find the deleted inodes with ls -d. Below is the stat output of the inode that was printed out with extundelete.

Inode: 2752521 Type: directory Mode: 0600 Flags: 0x80000
Generation: 3721224587 Version: 0x00000000:00000008
User: 1000 Group: 1000 Size: 0
File ACL: 0 Directory ACL: 0
Links: 0 Blockcount: 0
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x4e4b1371:9c020ff4 -- Wed Aug 17 13:03:45 2011
atime: 0x4e49c2a0:cabff3fc -- Tue Aug 16 13:06:40 2011
mtime: 0x4e4b1371:9c020ff4 -- Wed Aug 17 13:03:45 2011
crtime: 0x4dc900d0:b2307f68 -- Tue May 10 21:09:36 2011
dtime: 0x4e4b1371 -- Wed Aug 17 13:03:45 2011
Size of extra inode fields: 28

The size is reported as being 0. Does this mean that the data could be gone?