LinuxQuestions.org - .iso File recovery on EXT3 filesystem on Gentoo

Quote:

Originally Posted by sussane (Post 2992061)

i issued the commands below and now i can't find the ISO files :( on the hard disk.

Laying down a filesystem structure over the old one does not make sense. If you don't understand what a command does then please think first, then read about it and then ask if unsure.

Quote:

Originally Posted by sussane (Post 2992061)

i unmounted the drive and tried to mount again, but failed.

Give us (exact!) (error) messages to work on, not a vague description.

Quote:

Originally Posted by sussane (Post 2992061)

How can i use testdisk OR other free datarecovery softwares to recover all the .ISO files

The "how" of how to operate testdisk or gpart you can read in the manual, it isn't that hard to operate.
If unsure make a 'dd' copy of the disk to file so you have a backup to work on if you fsck up again.

Another option would be retrieving files directly with photorec or foremost or scalpel. These tools carve (string together bits of files) by looking for the start and end of file (file header and footer information, think "magic" as in the 'file' command). The problem is that finding an end-of-file marker however does not guarantee file integrity in any way: it may be missing pieces or stray data may have been trapped in it. (For OS install .iso's that would be easy to verify since the D/L page will list a MD5 or SHA1 hash value.) Another problem is (and I only tested this on a few .iso's) that neither photorec or foremost or scalpel has ready-made header plus footer for ISO 9660 and that header/footer carving relies on the signature starting in the first two bytes AFAIK, and with an ISO 9660 format file that's simply not the case, the first column represents the offset in the file where the string "CD001" is found:

Code:

grep -i 9660 /usr/share/magic

32769    string    CD001    ISO 9660 CD-ROM filesystem data

37633    string    CD001    ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)

So that's a bit of a dead. (That doesn't mean you could not retrieve data *from* a deleted iso since it's a simple filesystem. Mkisofs some dir with text files then grep the iso for a line and you'll see.) File carving may be helpful if the value of the data is greater than the time you have to invest in prepping and carving. But since these are readily available .iso's I'd say D/L them again. Besides that I've been only doing Forensics for so long. Maybe someone else has better ideas.