File undelete with TestDisk

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

File undelete with TestDisk

#1 Post by cgrenier »

TestDisk can recover deleted files from the following filesystem
- NTFS
- FAT1216/32, exFAT
- ext2
Use PhotoRec for other filesystems or if TestDisk doesn't find your files.

DSpider
Posts: 23
Joined: 29 Jul 2013, 10:41

Re: File undelete with TestDisk

#2 Post by DSpider »

So it is not possible with ext4 files ?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete with TestDisk

#3 Post by cgrenier »

When a file is deleted from an ext3 and ext4 filesystem, the location of the first block is zeroed, so TestDisk can list all filenames, deleted or not, but it's not possible to undelete them. PhotoRec can be use to recover files with known filetypes from the free space of the filesystem and recover them but without the original filenames.

gwaag
Posts: 2
Joined: 03 Sep 2014, 10:53

recovered video files are in segments

#4 Post by gwaag »

Hello.
I used testdisk photrec. Now a have hundrets of segments in the file on my extern USB drive which I used to store the recoverd files. The recoverd files come from a other USB drive which had the originals as ext4.
What can I do to get the videos as one file??
regard
gwaag

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete with TestDisk

#5 Post by cgrenier »

If the files were stored on an ext4 filesystem, when you run PhotoRec, you need to select "[ext] ext2/3/4", otherwise indirection blocks will not be detected.

Metallion
Posts: 4
Joined: 22 Mar 2016, 21:33
Location: Figueira da Foz, Portugal
Contact:

Re: File undelete with TestDisk

#6 Post by Metallion »

I saw somewhere in the internet that TestDisk 6.14 had an option to Undelete.
The actual version doesn't have it, at least, it seems that to me.

I'm trying to undelete some files that i had in my external disk (Mac formatted) with their original names.

I used the PhotoRec for a few days in a row, but lots of wavs, mp3, cpr, came corrupted.
(The wavs and mp3 higher than 10Mb usually are all corrupted)

Am i missing something?

Thanks in advance!

rktrcr
Posts: 1
Joined: 06 Oct 2016, 04:56

Re: File undelete with TestDisk

#7 Post by rktrcr »

I was an idiot today. I was backing up audit log files on multiple rhel 6 workstations. I moved/copied/tar multiple files into a dir once all files needed for back up are there I mkisofs of these files. after I make the iso on the remote workstations I scp them to the workstation I am at. once I verified the size of the iso image I scp is the same as the original I rm all the files. I did this on all the machines and got keyboard happy and actually deleted the directory that contained all the iso images. I have powered down the computer to hopefully keep these files intact. Can I recover just the .iso files using test disk or photorec? or will I need to try and recover all the audit files then start over? I am weary of installing livedisk on the hard drive I want to recover these audit log. Which LiveCD works best with RHEL 6? Would a live CD be the best option? or just install on the hard drive and hope for the best?

Aloha
Mike

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete with TestDisk

#8 Post by cgrenier »

You can use PhotoRec to recover the .iso. If needed, disable all other files in FIleOpts.

arisingtech
Posts: 4
Joined: 25 Aug 2022, 11:27

Re: File undelete with TestDisk

#9 Post by arisingtech »

I tried undelete on exfat and I was searching for .hds file but there is only one version.
Is it correct?
Can I see other version?

Regards
Roberto

Post Reply