Originally Posted by unSpawn
Never intended that way.
Not saying you meant it that way. But your comment made it clear to me how mis-funded my presumptions were... No offense taken anyway.
Originally Posted by unSpawn
The problem with file carvers like Photorec, Scalpel and Foremost is they need the files header and footer to work with (as in 'man magic') so they may well miss a file boundary (if the file doesn't have a footer signature), mistake contents of another file as part of it (due to indirect block allocation) or just fail to recover a file if there aren't any signatures. So apart from differences in recovery techniques I'd say the best maintained application with the largest file signature database should offer the best chance of recovery. But even if you manage to recover files there is no guarantee they're the files you're looking for or if they're still usable.
In short: YMMV(VM).
mainly recovered my Firefox cache - pretty useless to me.
went berserk. the original partition and dd_rescue dump I made of it were 16GB long. I ended up with an 82GB folder and it would have gone on but stopped because of lack of space on the output directory/partition. I don't really know why but something else I tried might explain it:
It is possible to recover multiple copies of some of your files if you deleted that file more than once; you'll need to decide which is the one you want to keep.
(taken from: http://www.datarecoverypros.com/reco...commander.html
I remembered Midnight Commander
had that functionality so I tried it too. But I could not cd to undel://sdb2 nor undel///dev/sdb2 (no such folder
exists). This may be because
First, this particular undelete trick only works for ext2 partitions.
(from the same article). I wasn't too sure that meant ext2 only and no ext3/ext4 or whether it might include those enhancements on the ext2 filesystem. Undeletion through Midnight Commander probably only supports ext2 - not ext3 nor ext4 - as it did not use journaling which was only implemented on ext3.
I could try Testdisk but my past tries and reads on this subject leads me to think I would likely just end up with a bunch of files I would have to look into one by one to try and get (only) some of them right.
So I guess I'll go for the saner way of getting my somewhat out of date backup of that data + resintall some default settings from the program packages (most of what was on thet partition were setttings and configurations) + retweak those settings where needed + try and use the method below to recover the few files I really need restored (first thing to do):
Recovering Deleted Files in UNIX on non-ext2 partitions
I'll edit this post and report back when I'm done.
In the meantime, the original question about getting Foremost and Scalpel to run did get solved. I didn't get the results I was hoping for but, as unSpawn pointed out, that was mostly my fault on one side and the limitations of those tools on the other.
But anyway, I did get those programs working so I'm marking this thread as solved.
Thanks for the tips, unSpawn!
EDIT: I tested the grep
method mentioned in the link posted above with a couple simple text files (shell scripts and apparmor profiles). The outpur was way too garbled and large for it to be practical, if at all useful, for my situation.
So I'm left with the much more traditional aproach of reinstall, restore backups, reconfigure, redo some work. Seems it will be the easiest and most effective way for me after all...