1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
|
LDE(8) Linux Programmer's Manual LDE(8)
NAME
lde - a curses based file system viewer/editor for Linux
SYNOPSIS
lde device
DESCRIPTION
lde supports the three most popular file systems under
Linux at the time of its inception: ext2fs, minix, and
xiafs. It also has minimal support for msdos FAT file
systems and a nofs system in which case lde will function
as a binary editor. lde will attempt to automatically
detect the file system present on the device or file when
it is started, if it does not recognize the file system
present on the device, it will default to nofs.
lde allows you to view and edit disk blocks in hex or
ASCII mode, view a block that contains directory entries
in a readable fashion, and view and edit formatted inodes.
lde is a great help when recovering deleted files (see
doc/UNERASE included with the lde distribution for more
info).
The device parameter is a required option for lde. If
omitted, it will print a warning and refuse to start. The
default mode for lde is to use a curses interface; this
can be overriden by some of the options listed below.
OPTIONS
-a, --all
Indicates that searches should be performed on the
entire disk. If -a is not specified, only data
zones which are marked not in use will be searched.
--append
Always append data to existing recovery file. If
file does not exist, create new file.
-b (--block) block_number
Format a single block as hex and dump it to stan-
dard output. Specify -N to dump more than one
block.
-B block_number
Format all blocks after specifed block_number as
hex and dump to standard output. You can use -N to
specify the number of blocks to display.
--blanked-indirects
Linux <= 2.0.33 blanks all the indirect blocks when
truncating an inode. The inode still knows where
the 1x/2x/3x indirect blocks are, but they're full
of zeros. This was a quick hack that works to
Linux 2.0 23 September 1996 1
LDE(8) Linux Programmer's Manual LDE(8)
restore small (>12k <~500k) unfragmented files. It
can be toggled via the flags menu in the curses
interface.
-d block_number
Dump a block's data to standard out as unformatted
binary data, ( like cat and faster than dd ).
Specify -N to dump more than one block.
-D block_number
Dump all blocks after block_number to standard out
as unformatted binary data. You can use -N to
specify the number of blocks to dump.
-f, --file recovery_file_name
Signal lde that we want to recover an inode to a
file and specify its name. You should specify the
inode number to be recovered with the -i option.
-g, --grep
This option was designed to work with grep output.
Grep a file for lost data, pipe it through awk to
yield just byte offsets where the desired string
lies. lde will then find the block corresponding
to the desired offset and try to find an inode
which references this block. A sample script is
included with the lde distribution (crash_recov-
ery/grep-inode).
-h, --help
Display extended help.
-i (--inode) inode_number
Format and dump a single inode to standard output.
Specify -N to dump more than one inode.
-I inode_number
Format and dump all inodes after inode_number to
standard output. You can use -N to specify the
number of inodes to display.
--indirects
Search the filesystem for blocks that looks like
indirect blocks.
--ilookup
When searching, if we find a match, activate this
flag to lookup the inode which contains the matched
block. It might be easier and faster to do this
with paper and use lde to interactively lookup only
the blocks which have a high probability of being
the one you want. --ilookup can also be used if
the -B or -b option is specified to try to find an
inode reference for the specifed blocks. When
Linux 2.0 23 September 1996 2
LDE(8) Linux Programmer's Manual LDE(8)
using -B you may want to specify -N also.
--logtofile
Debugging option. All of lde's messages will be
dumped to /tmp/ldeerrors.
-L --length
Sets search string length (when using -T with a
filename).
-N --limit
Sets the number of blocks to display when using
inode or block dumps. If unspecified, default is
to the end of the filesystem ( -I -B -D ) or a sin-
gle block ( -i -b -d ).
-N can also be used to specify a block to
begin/resume searching at. If unspecified in this
usage, it defaults to the first data zone.
-O --offset
Sets search string offset (when using -T with a
filename). The first byte in the template file is
0. When searching for matches, the block will be
examined starting at this offset.
-p, -r, --paranoid, --safe, --read-only
Open the device read only. Once set, this cannot
be toggled from within the program.
-q, --quiet
Turn off bell.
--recoverable
When searching, check that any inodes found contain
a deleted file that may be recovered. --ilookup
must also be activated for this option to have any
effect. If no blocks are marked used by another
inode, "recovery possible" will be printed. If
blocks are used by another file "recovery NOT pos-
sible" will be printed to the screen. You may
still be able to get some data back even when it
reports that recovery is not possible. To get an
idea of how many blocks are in use, you will have
to check its recoverablilty from lde via its curses
interface (see Recover mode below).
If --recoverable is used with -I 1 , it will check
all the deleted inodes to see if they can be recov-
ered. The deletion time of the inode will be
printed to the screen if it is recoverable.
-s (--bs or --blocksize) block_size
Override blocksize which lde has detected. The
Linux 2.0 23 September 1996 3
LDE(8) Linux Programmer's Manual LDE(8)
blocksize may have been read from the information
(superblock) stored on the disk or is what lde
would consider the default blocksize for that type
of filesystem (generally 1024 bytes). With this
option, you can force lde to use a different block-
size.
-S string
Search disk for data (of questionable usefulness).
This was more for searching for a specific type of
file (which is now easier with -T ) rather than
file data. To search for data or strings, use the
--grep option. If you insist on using -S which
might be prudent occasionally, The offset of the
string must be specified with -O , and each block
will only be inspected at that offset. If -O is not
specified, then 0 is assumed and the string must
lie at the start of a block. You can also specify
the block to begin/resume searching from with -N
which defaults to the first data zone.
-t fstype
Override the auto-detect. fstype = {no, minix,
xiafs, ext2fs, msdos}
-T type
Search disk for data. This will search the start of
each block for numbers found in /etc/magic for cer-
tain types of files, currently supported types are
{gz, tgz, script}.
Note: type tgz only finds tar files that were cre-
ated with gnu tar using its cfz options. Use gz to
find tar files that were compressed after creation
(or through a pipe?).
If you specify a filename after the -T option, it
will read in the first block of the file and search
the filesystem for something which matches it
exactly. This may be useful for finding deleted
copies of files (i.e. you've found version 1.0, but
deleted version 1.5 and now want to recover it) or
with the -L and -O options, you can pick off a few
bytes and search for magic numbers in a certain
file type. When using the filename option, you
really should specify -L and -O or they will
default to BLOCKSIZE and 0. You can also specify
the block to begin/resume searching from with -N
which defaults to the first data zone.
-V, --version
Display version information.
Linux 2.0 23 September 1996 4
LDE(8) Linux Programmer's Manual LDE(8)
-w, --write
Allow writes to the disk.
CURSES INTERFACE
The lde main screen displays the file system's superblock
in the workspace window. The header window will be the
same for all modes and indicates the program name and ver-
sion, the device, the current selected inode, and the cur-
rent selected block. There are also nine digits (and some
extra characters shifted-12456 on an American keyboard,
sorry I skip '#' which is reserved for another function)
"0123456789!@$%^" which indicate the status of a bogus
inode which can be used for file recovery. A digit means
the inode block entry has not been filled yet, a minus
sign indicates that it has been filled.
While displaying the superblock, you can use the following
keys which are valid in most modes:
b to enter block mode
d display the directory contents of the cur-
rent inode or block
f menu of runtime flags
i to enter inode mode
r to enter recover mode
s return to super block mode ( only valid from
other modes )
q to quit
v view the error/warning log
^L to repaint the screen
^O display menu of valid choices ( also F2 )
F1 display help screen ( also M-h or ? )
I have tried to implement cursor motion modes similar to
both vi and emacs (M = meta key, ^ = control key, ESC is
recognized as the meta key, M-ESC is recognized occasion-
ally as ESC -- to exit menus).
vi emacs
UP k ^P
DOWN j ^N
LEFT h ^B
Linux 2.0 23 September 1996 5
LDE(8) Linux Programmer's Manual LDE(8)
RIGHT l ^F
PG_UP ^U M-v
PG_DN ^D ^V
Inode mode:
Once in inode mode, the current inode will be dis-
played in the workspace window.
PG_DOWN
Make next inode the current inode.
PG_UP Make previous inode the current inode.
arrows Move cursor to different fields of inode.
Up and left go back one field, down or right
will go to the next field.
0123456789!@#$%^
Add corresponding block entry from this
inode to the recovery list.
B Switch to block mode, examining block under
cursor.
b Switch to block mode, examining current
block (displayed in status line).
c Copy inode to inode copy buffer.
e Edit inode information. Use the cursor to
select the field you want to edit, then hit
RET ^M ^J or e and a line will pop up at the
bottom of the screen, enter the new value
here. Entering a blank line will leave the
value unchanged.
Dates can be entered in any format other
than the one displayed on the screen. The
year must be kept near the month and day.
Use formats like "24SEP96 10:00:01" or
"10:00:01 Sep 24, 1996". "12/24/96" will
probably default to the American interpreta-
tion MM/DD/YY. I did not write the date
parser, so I don't want to hear any com-
plaints about it.
p Paste inode from inode copy buffer.
r Switch to recover mode.
R Switch to recover mode, copy current inode
Linux 2.0 23 September 1996 6
LDE(8) Linux Programmer's Manual LDE(8)
block information into recovery inode.
# This will prompt the user to enter a number
and it will then make that the current
inode. The number may be entered as hex-
adecimal (leading 'x', '0x', or '$'), octal
(leading ''), or decimal.
M-b View inode in its raw block format.
Block Mode:
In block mode, the current block will be displayed in hex-
adecimal and ASCII. The numbers along the left hand side
of the screen are hexadecimal offsets from the beginning
of the block. As much of the block as possible will be
displayed. If the block is marked unused, the central row
of ':' will spell out NOT USED.
PG_DOWN
Display next chunk of this block.
PG_UP Display previous chunk of this block.
+ Make next block the current block.
- Make previous block the current block.
arrow Move cursor.
b View block under cursor. lde will interpret
the byte under the cursor as the start of a
block pointer (as if it were part of an
indirect block). This will be a two byte
pointer for the minix file system, four
bytes for ext2fs and xiafs.
B Interpret blocks under cursor as a block
pointer and make it the current block.
c Copy block to copy buffer.
d Dump block as a directory (see directory
popup description below).
e Edit the data in hex or ascii mode. TAB (
^I) switches between hex and ascii editing.
While in hex edit, the keys A-F and
0123456789 will not perform their lde func-
tions, but are used to enter new data. In
ascii edit, most keys (chars 32-126) are
used to enter new data. Characters outside
this range must be entered in hex mode, they
Linux 2.0 23 September 1996 7
LDE(8) Linux Programmer's Manual LDE(8)
will be displayed on the ASCII display as a
period.
Editing will exit on write block ( ^W ) or a
command which goes to another block or
leaves block mode. To discard your changes
and re-read the block use ^A or view another
block and come back. You will always be
prompted [Yes/Discard changes/Continue edit]
before a write occurs. Select y to save the
block to disk, d to discard your changes and
re-read the data from disk, or c if you made
a mistake and want to go back and make some
more changes before saving this block.
It is probably a good idea to unmount the
file system before you do any writes to it.
My guess is that bad things will happen if
you try to write the inode/block tables
while someone else is using the filesystem.
I View inode under cursor. lde will interpret
the byte under the cursor as the start of an
inode pointer (as if it were part of an
directory entry). This will be a two byte
pointer for the minix file system, four
bytes for ext2fs and xiafs.
n, p Next/previous block in file. If the dis-
played file is indexed by the current inode,
you can step to the next or previous block
in the chain.
p Paste block from copy buffer.
w Write the current block to the recovery
file.
0123456789!@#$%^
tag this block to be recovered. Under
Minix, this will display nine blocks which
represent the block pointers in an inode.
0-6 are direct blocks, 7 is the indirect
block, and 8 is the double indirect block.
One day there may be an option for more
direct blocks to make recovery easier. When
a block is tagged, the status line will
reflect this. To untag a block, go to
recover mode and set the block's pointer to
zero.
# This will prompt the user to enter a block
number. The numbers may be entered in the
same format described in inode mode
Linux 2.0 23 September 1996 8
LDE(8) Linux Programmer's Manual LDE(8)
(decimal, hex, or octal).
^R Look up inode which references this block.
Search for a string. You will be prompted for a
case-sensative
search string. The search will proceede
from the current block, if a match is found,
the block pointer will be advanced and the
matching block will be displayed.
Recover Mode:
In recover mode, the tagged blocks are displayed and may
be edited by hand. When they are correct the user can
dump the file. The user is prompted for a filename which
can be 80 chars, the default file is "./RECOVER.file".
0123456789!@#$%^
Will prompt the user to enter a numeric
value for the specified block index. The
format of the input should be the same as
that described in inode mode.
c Check that all the blocks marked for recov-
ery are unused. Complete recovery will be
impossible if any blocks are reported in
use, but you might be able to salvage a
large chunk of your file.
r Write out the recovered file.
u Unmark all blocks. The recovery inode will
be filled with zeroes.
Directory View
Accessable from inode and block mode. In block mode, it
formats the current block as a directory entry with no
syntax checking (i.e. it might not really be a directory
block). In inode mode, it uses the block pointers to
determine what to display. You can use the up and down
arrow keys to scroll the display if there are too many
entries to display at once.
d If the cursor is on a directory, it will follow the
link and display that directory. Use D to do the
same and set the current inode to the new directory
inode.
i Set the current inode to the inode under the cur-
sor.
Linux 2.0 23 September 1996 9
LDE(8) Linux Programmer's Manual LDE(8)
I Set the current inode and immediately view it in
inode mode.
n, p Next/previous block in directory. If the directory
being viewed is indexed by the current inode, you
can step to the next or previous block in the
chain.
EXAMPLES (command line)
lde -I 1 -N 10 /dev/hda1
Display inodes 1-10 on the screen.
lde -b 34 /dev/hda1 | more
Display block 34 on the screen (formatted in hex
and ascii).
lde -D 100 -N 51 /dev/hda1 > MyOuput
Cat blocks 100-150 to stdout (binary data), which
is equivalent to
dd if=/dev/hda1 of=MyOutput bs=1024 count=51
skip=100
lde -I 1 --recoverable /dev/hda5
Display all inodes on /dev/hda5 which have been
deleted, but can be recovered.
lde -I 1 --recoverable /dev/hda5 | grep "Sep 23"
Display all inodes on /dev/hda5 which have been
deleted today September 23, but can be recovered.
The date format is that of ctime(3):
"Wed Jun 30 21:49:08 1993"
Note: the day will have a leading space if is less
than 10.
lde -b 100 --ilookup /dev/hda1
Find first inode that references block 100 on
/dev/hda1 (to search for multiple occurances, use
the curses interface).
lde --paranoid -T tgz --ilookup --recoverable /dev/hda5
Find all tgz files which have been deleted, display
possible inodes and check if it is possible to
recover the files, open the file system read only
while searching.
See docs/UNERASE included with the lde distribution for
more examples and instructions for the best way to go
about restoring files.
Linux 2.0 23 September 1996 10
LDE(8) Linux Programmer's Manual LDE(8)
SEE ALSO
fsck(8), fsck.minix(8), e2fsck(8), xfsck(8), debugfs(8)
AUTHOR
Scott D. Heavner (sdh@po.cwru.edu)
Linux 2.0 23 September 1996 11
|
