If I rename a file with mv command like:
mv original_file_name new_file_name
Is this possible to recover the original filename on Linux Ext4 file system and if so how that can be done?
Asked
Active
Viewed 614 times
1
Andrew Domaszek
- 5,103
- 1
- 14
- 26
user164863
- 117
- 7
-
2No, it's gone unless you took steps to preserve it through snapshotting or filesystem backups. – Andrew Domaszek Mar 30 '17 at 20:36
-
@AndrewDomaszek Sounds good, do you want to post that as an asnwer? – user164863 Mar 30 '17 at 20:44
-
Hard links are technically different names to the same file. So theres also a tiny chance you have the original file kept in a hard link. – Matthew Ife Mar 30 '17 at 22:05
1 Answers
3
At the filesystem level, this operation can not be undone: you changed the name assigned to a specific inode, without preserving its previous name.
That said, a very small chance exists to retrieve the original name by reading backward the filesystem journal. However, as the journal is a circular buffer (ie: it is continuously overwritten), you need to immediately remount the filesystem readonly and use specialized tools to analyze the journal.
It is way simpler and effective to search the previous name in system logs and the likes: for your example, an extremely simple history command would reveal the mv command in its entirely, showing both old and new filename.
EEAA
- 108,414
- 18
- 172
- 242
shodanshok
- 44,038
- 6
- 98
- 162
-
Much better answer than mine. The short version is the directory file where the filenames are stored is not backed up. – Andrew Domaszek Mar 30 '17 at 20:53