6

I have a partition raw image on which I am trying to run extundelete to undelete some files from an ext4 filesystem. Unfortunately extundelete exits with a segmentation fault.

Is there anything I can do?

root@ubuntu-VirtualBox:~# extundelete --restore-all mmcblk0p7.raw 
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
y
Loading filesystem metadata ... 218 groups loaded.
Loading journal descriptors ... 27292 descriptors loaded.
Writing output to directory RECOVERED_FILES/
Searching for recoverable inodes in directory / ... 
398 recoverable inodes found.
Looking through the directory structure for deleted files ... 
Unable to restore inode 1548814 (lost+found/.Skybox.Cache): No data found.
Segmentation fault (core dumped)
root@ubuntu-VirtualBox:~#

dmesg gives only:

[90218.617232] extundelete[3924]: segfault at 178255 ip b76cd374 sp bfda0d30 error 4 in libext2fs.so.2.4[b76b6000+43000]
Kamil Maciorowski
  • 69,815
  • 22
  • 136
  • 202
Mel
  • 225
  • 4
  • 9
  • Does it do the same thing if you do `extundelete --restore-file path/to/deleted/file`? Though if the file system really is still mounted, your odds of recovering the file are decreasing with each passing minute (e.g. swap, temp, etc, could easily be overwriting the space where the file is . . . ) – ernie Mar 18 '14 at 20:39
  • Seeing this with Kubuntu 12.04. @emie: Not sure about the OP but I saw this with a specific _path_ (not necessarily a specific _file_). – einpoklum Jun 08 '14 at 15:47

2 Answers2

4

It turns out the ubuntu build has some problems. Building from source helps:

apt-get remove extundelete
apt-get install build-essentials e2fslibs-dev
tar -xjf extundelete-VERSION.tar.bz2
cd extundelete
./configure
make
src/extundelete --restore-all image.raw
Mel
  • 225
  • 4
  • 9
0

"A segmentation fault core dump is not due to user unfamiliarity. It is a program misbehavior outside the user control. In this case it appears that the extundelete utility has fallen out of maintenance and that it requires a version of e2fsprogs that is too old for up to day system. Have you given a try to testdisk or Photorec?" https://www.unix.com/fedora/279812-segmentation-fault-while-trying-recover-file-extundelete.html

alchemy
  • 240
  • 2
  • 9