Sample Header Ad - 728x90

Can I use grep or strings to seach for deleted file name on btrfs?

0 votes
1 answer
45 views
Months ago, one of my systemd journal files was purged from my btrfs hdd. Because I couldn't use file carving to check if the content is still on the hdd because unfortunately the format is binary and not text, I can at least look for the metadata of this file (inode is called?). For this, can I just use grep or strings over my sda1 and search for the filename? If I find something then I will see which blocks it points to and try recover the actual content of the journal file... I know there are btrfs-undelete scripts but I don't see the point of using them at least in this case.
Asked by user324831 (113 rep)
May 31, 2025, 09:22 PM
Last activity: Jun 1, 2025, 07:40 AM