Can I Recover Files From the iNode?

Check out the iNode info in this thread: Big iNode file in lost+found

Sorry, I know nothing about iNode files. Will place a "Bat Call" for you for knowledgeable users who can help you.

Placed the "Bat Call." Hopefully, a knowledgeable user will be along shortly to help you.

That sounds like your disk catalog was damaged. The catalog stores the filenames & other info about files, the actual data of the files are stored somewhere on disk & referenced by the inode number.

When the catalog is gone so is the 'metadata' about the files. It means you have the data portion but no way to recover the correct file name etc.

I think you have an arduous process of selecting files & giving them the correct extension & names. I really don't see how you can automate this since the original data is missing. You may need to look at tools that identify files by the header like the unix 'file' command.

Forensic software may be able to help some can 'carve' files from disks & identify the files by the header, 'magic bits' or file signature but that is complex & often expensive or command line software.

I suspect file juicer may help, but it still can't restore the original names & folder structure.

http://echoone.com/filejuicer/

Whatever you decide you want to avoid editing your originals, make a copy. If you find some better tools in a few weeks you can redo the process unless you have edited the originals.

The recovered inodes will also contain deleted files, so some files will be incomplete but may exist elsewhere in the full form.

It just occurred to me that some files have data within them that may be useful.

Image files may have exif data (creation date, camera etc). I'm not sure how you can easily extract that info & rename the files. There are some command line tools that do it if you want to make your own scripts or there are apps like 'A better finder rename' that claim to parse exif & rename files.

http://www.sno.phy.queensu.ca/~phil/exiftool/<-- Command line tool

http://hvdwolf.github.io/pyExifToolGUI/<-- A GUI for the same tool

http://www.publicspace.net/ABetterFinderRename/Manual_EXIF.html

I'm hoping someone else has a better solution, this seems very manual & involved but you may be able to get to a usable state if you try a few approaches.

Just to be pedantic - it isn't converting the files, it is just detecting what type they are & adding the correct file suffix. 🙂

Bear in mind it is extracting the files, so you may find that it pulls images out of some file types e.g. the album art from music files or images from Word docs. It's another reason to keep your originals safe, other tools may get different data from the files.

Good luck with it.

If you have a list of inode numbers, then the find syntax will show the following information:

1. inode
2. full path including filename
3. permissions
4. username
5. groupname

For example, I have a file named tv.py, in my home directory. It is a Python script. Its inode number is 27350538. The following Terminal command will return the above listed elements about this inode, provided the file has not been deleted. If I had hard linked the tv.py file to foobar.py, then find would return two filenames associated with the same inode. If this had been a soft link, then another inode number would be assigned to it. I use -xdev (GNU compatibility) or -mount (OS X) to avoid the time delay of searching all mounted filesystems. The $HOME and ~ character are interchangeable.

find $HOME -inum 27350538 -xdev -exec stat -f "%i %Sp%LT %Su %Sg %SN %SY" {} \;

Output: 27350538 -rwxr-xr-x* viking staff /Users/viking/tv.py

If you wanted verbose output to replace the one liner output above:

find $HOME -inum 27350538 -exec stat -x {} \;

Once you have the filepath associated with a single inode, then you can rename the inode to the filename in the filepath.

mv 27350538 $HOME/tv.py

VikingOSX,

Is this going to work for files that have been recovered & copied to another disk using 'filename_inode' as an actual filename?

I may have misunderstood the original post – I'm under the impression the files were pulled off a failed disk & the original disk catalog is gone. Now the new catalog has names without a suffix, so the file type need to be detected to allow files to be useful.

Drew,

The OP probably has an external disk with just integer inode names on it. Since filename information is not stored in the inode, and if the original drive was lost, the underlying system calls that map inode to filename may just bork. The OP will have to test the find syntax on one inode to evaluate the result.

Glad you brought this up, as our suspicions now align. The result could be a surprise, but now I wonder if the OP is stuck with inodes that can't be remapped to their original pathnames, and has 175GB of useless data.

@ Drew Reece & VikingOSX

Hehe, cheers 🙂