-   Linux - Software (
-   -   Using Foremost and general "undelete" questions - Linux Mint GNOME (

Last_Dino 03-15-2010 05:12 PM

Using Foremost and general "undelete" questions - Linux Mint GNOME
I am running Linux Mint 6 x64 and GNOME w/ all or most updates.

I mistakenly deleted a folder containing many of my movies that I have transcoded from my collection. I have attempted to restore the files using Foremost, and once I got it working, I found that Foremost was able to restore or partially restore many previously deleted videos, but not any of the most recently deleted files. I am not sure how many total videos, but I estimate that I had 15-30 movies in the folder.

Here is what happened: I had two folders and pressed Delete with the wrong folder selected (somewhat Ironically I was in the process of backing the data up). A message box poped up saying something to the effect of "these files cannot be sent to the Trash, would you like to delete them?" I clicked yes. When I checked the Trash, they were of course not there.

The files are located on a dedicated drive (single partition) that has not been mounted since the incident, except for while attempting recovery.

Is it possible that Foremost cannot detect them because they are still intact somewhere? Are they too big for the program to handle? Should I be using another program or method?

Thanks in advance.

pljvaldez 03-15-2010 05:31 PM

You can try using photorec (part of the testdisk suite). I haven't tried using either one on large files, so I can't say if that's a problem or not. But if they're intact, they should be detected unless they are malformed in some way that makes the recovery program misidentify them.

Last_Dino 03-16-2010 12:25 AM

pljvaldez, thanks for the recommendation! Photorec worked great! I recovered parts of at least 5 of my movies, including one complete from start to finish. The remaining movies are presumably too damaged to recover (missing headers, too fragmented, or missing significant data.

I have also found that the program runs just fine without the drive mounted, which is what I would recommend for anyone attempting this process, in order to preserve the deleted data. This program was fast, effective, and easy enough for a beginner to use.

All times are GMT -5. The time now is 11:29 AM.