ralf(8) - Linux man page

Name

R.A.L.F. - Recover A Lost File, a tool to undelete an (accidentally) deleted file from ext2/ext3 file systems

Synopsis

ralf fileName [options]

ralf --help

Available options:

[+d] [--debug] [-d] [--nodebug] [+s] [--silent] [-s] [--nosilent] [--freespace] [--wholespace]

Description

R.A.L.F. is a wrapper to a collection of tools needed for successfully recovery of files deleted from ext2/ext3 file systems. If you simply want to restore all deleted files from the entire file system, you better use tools like PhotoRec or foremost directly (they simply restore everything they find, and you can restrict by file types and file system only). Using tools like fls, fsstat and dls from the Sleuthkit, we can restrict further - and that's what Ralf does.

Recovery of lost files from ext2/ext3 file systems is not that easy, and requires multiple steps. R.A.L.F. automates these steps, thus speeding up the recovery process. Based on the file name you provide on the command line, R.A.L.F.

- checks on which device the file has been, selecting this as "Source Device" - asks the user to specify a device other than the source to restore to. Restauration must be done on a different device, to prevent the data from being overwritten during the restauration process - finds the range of file system blocks the file belongs to, and copies these blocks to an image file on the target device - runs PhotoRec (or foremost) to extract all files found in this image. We need to extract them all, since we cannot tell which one is the correct file
Once the script has completed its tasks, it tells you the location where the recovered files are stored. Now the only task left to you is to finally identify the wanted file - and remove the rest (if not needed). However, keep in mind that R.A.L.F. may fail - which can be due to different reasons:
- The data blocks (or even iNode) may already have been re-occupied by a newer file - file system corruption could be present - the script itself may be full of bugs...
So we can give no guarantee but that the script (and its required components) consume additional space on one of your disks, once you have them installed. You use it at your own risk - the authors cannot be made responsible for any negative results, damages, etc.pp. (you find these details in the license information, installed to the docs directory).

Options

--help
Display some help (list syntax and available options) and exit.
+d
--debug: Enable debug output. This is mainly used during development, but also useful to track errors to report
-d
--nodebug: Disable debug output. You will usually not need this - unless you set DEBUG=1 in your configuration file.
+s
--silent: Make the script less verbose by disabling most of the progress messages. Questions will be asked, though, if your input is needed :)
-s
--nosilent: Enable progress messages. You usually will not need this switch - unless you set SILENT=1 in your configuration.
--freespace: Tell PhotoRec to recover only from free (currently unused) space. Has effect for PhotoRec 6.9+ only.
--wholespace: Tell PhotoRec to recover from the entire (used and unused) space. This may also include files which are not (yet) deleted. Has effect for PhotoRec 6.9+ only.

Configuration

Some basic configuration can be done in /etc/ext3undel/ext3undelrc (or $HOME/.ext3undel/ext3undelrc, after copying the file there), where you will also find a description on what they do. R.A.L.F. first tries to read its configuration from the global configuration, and then overwrites them with the user specific ones (if found).

Messages And Exit Calls

R.A.L.F. uses exit codes according to the Linux specifications (see http://rute.2038bug.com/node7.html.gz, section 4.2). Basically these are here:

Code Description 0 Everything went fine - or the user (= you) decided to answer "N" to some question on whether to continue 1 Operation not permitted (e.g. script run without root privileges) 2 Some file was not found 19 (Source) device could not be determined
Except for those, error codes from other programs called (such as PhotoRec or foremost) are simply returned by the script as well.

Files

/etc/ext3undel/ext3undelrc

/usr/bin/ralf

/usr/share/doc/ext3undel/*

Author

This manual page was written by Andreas Itzchak Rehberg (devel@izzysoft.de), the author of the program. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2.

More information may be found on the authors website, http://www.izzysoft.de/