Ivan Kuzmenko rndtrash

Recovering deleted files in Ubuntu with ext4 filesystem

Recently, I deleted some files by mistake in a Ubuntu machine with an ext4 fs. These notes document the steps I took to get them back.

this procedure assumes that the partition that contained the deleted files is different from the root partition, as that was the scenario with which I had to deal (deleted files were in my home dir). The procedure needs that the partition that contained the files is unmounted, so if the deleted files were in the root partition, the process would be a bit different (e.g. storing the fs journal in a USB stick, using a live CD/USB to boot and issue the commands, etc.)
if something is not clear, you need more information, etc. check the sources below

With that out the way, let's begin.

	# script for QuickBMS http://aluigi.altervista.org/quickbms.htm

	idstring "PAK "
	get UNK long
	get FILES long
	math FILES ^ 0xa3da79b6
	get STR_TABLE_SZ long
	get DIR_STR_SZ long
	savepos TMP
	getdstring DIR_NM DIR_STR_SZ

	// M2C Decompiler Plugin
	//@author InusualZ <Wesley Moret>
	//@category Decompiler
	//@toolbar world.png
	//@keybinding: ctrl-shift-m

	import ghidra.app.script.GhidraScript;
	import ghidra.program.database.ProgramDB;
	import ghidra.program.database.code.CodeManager;
	import ghidra.program.database.code.InstructionDB;

	<script>
	import { onMount } from "svelte";
	import editorWorker from "monaco-editor/esm/vs/editor/editor.worker?worker";
	import jsonWorker from "monaco-editor/esm/vs/language/json/json.worker?worker";
	import cssWorker from "monaco-editor/esm/vs/language/css/css.worker?worker";
	import htmlWorker from "monaco-editor/esm/vs/language/html/html.worker?worker";
	import tsWorker from "monaco-editor/esm/vs/language/typescript/ts.worker?worker";

	let subscriptions = [];
	export let content;


	using Sandbox;
	using Sandbox.UI;

	internal class RadialFill : Panel
	{

	public float BorderWidth { get; set; } = 20;
	public float EdgeGap { get; set; } = 2;
	public int Points { get; set; } = 64;

	/**
	* !!!! This code doesn't work anymore !!!!
	*
	* - You can check working code on comments. I won't update this code anymore.
	*
	* Also, I just decided to remove this code. You can check revisions for old code.
	* Since this code was made for discord client that almost 5 years ago, It seems like doesn't work anymore.
	* I don't want people keep arguing in the comments, i decided to remove this code.
	*
	* Note: This code is now fulfilled with Javascript comments. This code won't work even if you pasted to console. doesn't do anything.

	# hapi + socket.io with cookie auth

	hapi と socket.io の組み合わせで、 socket.io 側で hapi の cookie からユーザ情報を取得

	※ Gist にフォルダを作れないので、 `___` を `/` に読み替え

	.main_loop
	jsr keyboard_read
	jsr rs232_try_read_byte
	cmp #0
	bne .got_byte ; if we got a byte from serial conn, goto .got_byte...
	jmp .main_loop ; ... otherwise, jump back to .main_loop
	.got_byte
	ldy flash_screen_on_data
	beq .skip_screen_flash ; if screen flashing is not enabled, jump over flashing code
	inc $d020 ; border_color++