LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-05-2018, 06:06 PM   #1
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,793

Rep: Reputation: 49
extundelete - need help formulating the command


I'm reading the man page and I'm just confusing myself or not understanding, hoping someone has done this before and can help me out.
I'm going to boot off a live USB and want to run extundelete to search for deleted files (ideally only *.jpg well say for example) on /dev/sdb in the /home/username folder only. but i'd like to restore them to the live USB so i can review them and copy them off somewhere else rather than restore to the drive i'm trying to recover from. I'm afraid to even run it wrong to lessen my ability to recover the files by accidentally restoring stuff to the real drive.
 
Old 06-05-2018, 07:17 PM   #2
BW-userx
LQ Guru
 
Registered: Sep 2013
Location: Somewhere in my head.
Distribution: Slackware (current), FreeBSD, Win10, It varies
Posts: 9,951

Rep: Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146Reputation: 2146
first off before I even look into that program, a live usb OS will not keep them as soon as you shut it down everything you've put on the stick, providing you can, will be lost.

your best bet is to see if it allows restoring else where and direct the files to another usb port for an external hdd of some type where a more permanent means of storing them can take place.
 
1 members found this post helpful.
Old 06-05-2018, 07:23 PM   #3
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,793

Original Poster
Rep: Reputation: 49
Yeah, I learned that lesson about the live USB before the hard way

I was hoping to restore whatever it could find to another USB, but looking through the options, i'm either just struggling with it or everything i want to do doesn't exist, but i just wanted a second opinion to make sure I just wasn't being dumb
 
Old 06-06-2018, 02:10 PM   #4
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 14,616
Blog Entries: 9

Rep: Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096
https://www.startpage.com/do/dsearch...th+extundelete
 
Old 06-06-2018, 02:20 PM   #5
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,793

Original Poster
Rep: Reputation: 49
Thanks, extremely helpful, I prefer other engines myself though

What I still don't see is how to look for only certain file types but like i previously said, need to do some more testing with it.

Was hoping someone was knowledgeable enough to simply help with a few concerns I had, but alas, to the Googles. Thanks for trying guys.
 
Old 06-07-2018, 07:13 AM   #6
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,513

Rep: Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007
extundelete is almost useless. In my experience it recovers about 1% of the files. If you want to recover files by extension, use foremost. Or, if you want just a general recovery tool, try testdisk. extundelete will recover the all of file names, but most of the files will be unreadable, incomplete or empty. Foremost is the best tool I've used for your particular application.
 
1 members found this post helpful.
Old 06-07-2018, 07:56 AM   #7
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,793

Original Poster
Rep: Reputation: 49
Thanks Awesome. Not that I've even gotten it to work, but I may tend to agree with you on extundelete just based on the man page alone
So reading the man page for foremost, this sounds like exactly what I'm trying to do "Recover files from a disk image based on file types specified by the user using the -t switch." But, in it's list of formats, it doesn't include ogv (or even ogg which covers ogv in photorec). So based on the format of what I'm trying to recover, will it still work? The man page makes it seem like the "all" just does the specifically mentioned formats only, but maybe I'm reading it wrong.
 
Old 06-09-2018, 12:19 PM   #8
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,513

Rep: Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007Reputation: 1007
There is a foremost.conf file. You add lines for custom files. Each custom file type is represented by
Quote:
extension case sensitive?y/n maximum size header footer
So, find some file of the type you want to recover and
Code:
$ hexdump -C file.ogg | less
and copy the first several bytes, in this case
Code:
4f 67 67 53
That's the header for ogg files.

In foremost conf you have to write the header as /x4f/x67/x67/x53. To find the footer, use the hexdump command without less. Ogg doesn't have a common footer, so it can be left out of the conf file entry.
 
1 members found this post helpful.
Old 06-10-2018, 08:01 PM   #9
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,793

Original Poster
Rep: Reputation: 49
Thanks. The guy ended up booting his computer and doing work on it, so I almost think it's a lost cause at this point.

Funny thing, on my machine, I created a dummy ogv, deleted it, and just as a test immediately ran testdisk and it found the file as zero bytes and didn't recover it. Didn't realize the option to recover files was moved. but oh well. recovery is always a longshot at best.
 
Old 06-10-2018, 11:18 PM   #10
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 14,616
Blog Entries: 9

Rep: Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096Reputation: 4096
^ the file extensions do not always match.
i said that before in this thread.
you cannot trust testdisk/photorec to recognize every file extension correctly.
doesn't mean it can't recover them.
 
Old 06-11-2018, 06:15 AM   #11
rjo98
Senior Member
 
Registered: Jun 2009
Location: US
Distribution: RHEL, CentOS
Posts: 1,793

Original Poster
Rep: Reputation: 49
Yup, was more just posting that for thoroughness than anything in case someone else finds this thread later and uses it for help with their issue.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Unable to Install extundelete-0.2.0. akhile04 Linux - Newbie 3 08-23-2013 03:04 AM
[SOLVED] need help to compile extundelete on slackware 11.0 - libext2fs too old Barx Slackware 4 09-28-2012 05:26 AM
Recover deleted .ecryptfs folder using extundelete in Ubuntu ambivalent Linux - Newbie 23 09-17-2012 03:51 AM
[SOLVED] problem compiling extundelete-0.2.0 cjfriar Linux - Newbie 2 08-29-2011 06:30 AM
Trouble formulating a correct wget call to download a college website, notes and all. chuckleberry Linux - Software 7 12-28-2005 05:32 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 06:30 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration