Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
PANIC - Undeleting file from EXT4
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Holysword
l33t
l33t


Joined: 19 Nov 2006
Posts: 946
Location: Greece

PostPosted: Mon Apr 21, 2014 7:17 pm    Post subject: PANIC - Undeleting file from EXT4 Reply with quote

So yeah... I spend a few days trying to record something... it took me several attempts to get it right and then when I use mencoder to downsample and compress it, *pooof* things crash, original video disappears and a small part of the downsampled video is still there to tell the story.

Trying to put the rage aside, I am trying to undelete the file. I booted from SystemRescueCD, the filesystem containing it isunmounted. I know the path (of course) but the file was replaced many, many times; every attempt I restarted recording it again with the same name, overriding the file. The file is very large, a little more than 30GB. extundelete is being unable to find the file:

Code:
root@sysresccd /root % extundelete --restore-file /home/holysword/SpiderOak\ Hive/itf.mkv /dev/sda3
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 2400 groups loaded.
Loading journal descriptors ... 30875 descriptors loaded.
Unable to restore inode 7745731 (home/holysword/SpiderOak Hive/itf.mkv): No data found.
Unable to restore file /home/holysword/SpiderOak Hive/itf.mkv
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem
root@sysresccd /root %

This is the path from the root of the partition; should I mount it? Am I using this correctly?

I am running also photorec software, but I am a bit afraid that I will run out of disk space, since it copies the files from /dev/sda3 to another partition. Please, suggestions? I need this REALLY SOON or I will be doomed! Tomorrow I will NEED TO mount this partition and use it normally!
_________________
"Nolite arbitrari quia venerim mittere pacem in terram non veni pacem mittere sed gladium" (Yeshua Ha Mashiach)
Back to top
View user's profile Send private message
windex
n00b
n00b


Joined: 09 Dec 2012
Posts: 70

PostPosted: Wed Apr 23, 2014 7:50 pm    Post subject: Reply with quote

Usually I'd use a tool called foremost for something like this, although it's conceivable that foremost may not have a signature for this sort of file.

What file type (extension?) was the deleted file? In theory you could develop a signature if you really had to.

Foremost is actually pretty good.
Back to top
View user's profile Send private message
Holysword
l33t
l33t


Joined: 19 Nov 2006
Posts: 946
Location: Greece

PostPosted: Tue Apr 29, 2014 3:51 am    Post subject: Reply with quote

windex wrote:
Usually I'd use a tool called foremost for something like this, although it's conceivable that foremost may not have a signature for this sort of file.

What file type (extension?) was the deleted file? In theory you could develop a signature if you really had to.

Foremost is actually pretty good.

Thank you for your suggestion, but it was really too late! I needed the answer really quick and then the file was lost forever. I will keep in mind your suggestion for next time though.
The file was .mkv
_________________
"Nolite arbitrari quia venerim mittere pacem in terram non veni pacem mittere sed gladium" (Yeshua Ha Mashiach)
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum