LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > General
User Name
Password
General This forum is for non-technical general discussion which can include both Linux and non-Linux topics. Have fun!

Notices


Reply
  Search this Thread
Old 09-11-2019, 03:46 PM   #1
Angus
LQ Newbie
 
Registered: Nov 2009
Location: Ottawa, Canada
Distribution: Ubuntu
Posts: 10

Rep: Reputation: 0
Next step when extundelete and testdisk fail?


I accidentally deleted a large compressed file on an ext4 file system. Unfortunately, I didn't realize that I'd done until a couple of reboots. I tried extundelete, which just told me it couldn't recover the file and testdisk decided that the file was 0-length, so it restored a 0-length file. I called a recovery guy who told me I'd have to commit to several bills before he was willing to try. Since I'm not very confident that it could be done, I'm not willing to risk that.
Is there anything I can do? Is there some way I can at least confirm whether or not it's lost forever?
My system is Ubuntu 16.04.
 
Old 09-11-2019, 06:06 PM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 18,127

Rep: Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923
Testdisk has a companion product photorec that is more designed for finding deleted files. Some caveats:
- depending on how large your file is, it may be spread around (fragmented). May or may not matter.
- scanning a disk means just that - it reads, and processes every sector on this entire disk. Can take hours/days.
- filenames are lost.

Generally I have had good results. Looks like most archive formats are supported - have a look here. Specifying what filetype you are interested in saves a lot of work later. Point the output to another filesystem, and if you're lucky you might be able to pick your quarry from its size.
 
Old 09-12-2019, 01:23 AM   #3
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 12,463
Blog Entries: 9

Rep: Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372Reputation: 3372
Quote:
Originally Posted by Angus View Post
I accidentally deleted a large compressed file on an ext4 file system. Unfortunately, I didn't realize that I'd done until a couple of reboots. I tried extundelete, which just told me it couldn't recover the file and testdisk decided that the file was 0-length, so it restored a 0-length file. I called a recovery guy who told me I'd have to commit to several bills before he was willing to try. Since I'm not very confident that it could be done, I'm not willing to risk that.
Is there anything I can do? Is there some way I can at least confirm whether or not it's lost forever?
My system is Ubuntu 16.04.
The data is very likely still there, just not the filename anymore.
testdisk/photorec are a little complicated, better read the wiki before you start using it.
But first:
  • do not boot the system anymore
  • create a full 1:1 clone of the partition in question
  • if you plan on booting the system again before you recovered your files, create another full 1:1 clone that you leave untouched
  • work on the first clone only
 
Old 09-12-2019, 03:23 AM   #4
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 18,127

Rep: Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923
There is no need to clone the filesystem simply to recover a file - booting from a liveCD is sufficient. Photorec will not update the source if precautions are taken to ensure the target is on another filesystem. Works fine.
Not that I'm usually against any form of backup ...
 
Old 09-12-2019, 08:11 AM   #5
Angus
LQ Newbie
 
Registered: Nov 2009
Location: Ottawa, Canada
Distribution: Ubuntu
Posts: 10

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by syg00 View Post
Testdisk has a companion product photorec that is more designed for finding deleted files. Some caveats:
- depending on how large your file is, it may be spread around (fragmented). May or may not matter.
- scanning a disk means just that - it reads, and processes every sector on this entire disk. Can take hours/days.
- filenames are lost.
Well things, *are* looking up. The file is 150Gb: definitely spread around. It's also xz compressed, which I see is supported. I'll give it a whirl tonight.
To save time: do you think this is the sort of thing that can be done on an Ubuntu 16 LiveCD? That's what I already have burned (don't let the "CD" part fool you, it's a DVD). I've already had to do things like enable "universe" to install things like TestDisk, so if that's all that's required, I should be good to go.
Out of curiosity: does it really scan the whole disk? Not just the partition and just the free space parts of the partition?
 
Old 09-12-2019, 08:45 AM   #6
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 18,127

Rep: Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923
Should work fine on on 16 - if not just install the current version. Installs on a liveCD go into RAM; no problem.
Sorry about the "entire disk" comment - ignore that for photorec. Feel free to try the free space scan only - I don't think I've ever done that; I always scan the lot. Old habits die hard.
 
Old 09-12-2019, 05:33 PM   #7
Angus
LQ Newbie
 
Registered: Nov 2009
Location: Ottawa, Canada
Distribution: Ubuntu
Posts: 10

Original Poster
Rep: Reputation: 0
Ok, I've got it doing its thing and it estimates another 9 hours, but the problem is, it's recovering *everything*. I only have enough space on the recovery system for this file. I might not have space for everything it's able to recover. Can't I just limit it to *.xz files that are approximately 150Gb?
 
Old 09-12-2019, 06:05 PM   #8
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 18,127

Rep: Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923Reputation: 2923
You can limit it to a class of flies - but it'll go looking for them all. No way to limit it by size that I'm aware of.
 
Old 09-12-2019, 06:11 PM   #9
Angus
LQ Newbie
 
Registered: Nov 2009
Location: Ottawa, Canada
Distribution: Ubuntu
Posts: 10

Original Poster
Rep: Reputation: 0
Well, if I limit the class that might be enough. I didn't see that option though. How do I do it?
 
Old 09-12-2019, 06:27 PM   #10
Angus
LQ Newbie
 
Registered: Nov 2009
Location: Ottawa, Canada
Distribution: Ubuntu
Posts: 10

Original Poster
Rep: Reputation: 0
Ok, I think I know what to do. I found the "File Opt" and spent the time unchecking everything except xz.
If I do see that it's recovering too many xz files (i.e. not the one I want and they are too big) is it safe to delete them during the recovery? Photorec won't freak if it can't find files it knew it recovered?
Edit: actually, I've tested the integrity on some of those files and so far all of them are corrupted. I had the idea it was only going to recover what was completely recoverable.

Last edited by Angus; 09-12-2019 at 07:13 PM. Reason: files are corrupted
 
Old 09-13-2019, 08:11 AM   #11
Angus
LQ Newbie
 
Registered: Nov 2009
Location: Ottawa, Canada
Distribution: Ubuntu
Posts: 10

Original Poster
Rep: Reputation: 0
Ok, now I'm not sure what to think. I left it overnight and by the morning, I found the xz 5.2.4 appraised all recovered xz files as corrupted. Furthermore, the recovery file system was full. So... should I just go out and purchase a 2.5" drive to make sure I can get everything or is there a way to get to be more efficient w/what I've got? And why is it recovering files that are found to be corrupted?
 
  


Reply

Tags
undelete


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] if [[ -n "$1" ]]; then FAIL FAIL FAIL rbees Programming 7 03-25-2015 02:39 PM
[SOLVED] need help to compile extundelete on slackware 11.0 - libext2fs too old Barx Slackware 4 09-28-2012 05:26 AM
Recover deleted .ecryptfs folder using extundelete in Ubuntu ambivalent Linux - Newbie 23 09-17-2012 03:51 AM
extundelete returns "no undeleted copies found in journel" every time. ununun General 0 08-14-2012 08:20 AM
[SOLVED] problem compiling extundelete-0.2.0 cjfriar Linux - Newbie 2 08-29-2011 06:30 AM

LinuxQuestions.org > Forums > Non-*NIX Forums > General

All times are GMT -5. The time now is 10:48 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration