Page 1 of 1

File undelete with TestDisk

Posted: 26 Mar 2013, 08:11
by cgrenier
TestDisk can recover deleted files from the following filesystem
- FAT1216/32, exFAT
- ext2
Use PhotoRec for other filesystems or if TestDisk doesn't find your files.

Re: File undelete with TestDisk

Posted: 01 Aug 2013, 09:41
by DSpider
So it is not possible with ext4 files ?

Re: File undelete with TestDisk

Posted: 17 Aug 2013, 09:20
by cgrenier
When a file is deleted from an ext3 and ext4 filesystem, the location of the first block is zeroed, so TestDisk can list all filenames, deleted or not, but it's not possible to undelete them. PhotoRec can be use to recover files with known filetypes from the free space of the filesystem and recover them but without the original filenames.

recovered video files are in segments

Posted: 03 Sep 2014, 12:17
by gwaag
I used testdisk photrec. Now a have hundrets of segments in the file on my extern USB drive which I used to store the recoverd files. The recoverd files come from a other USB drive which had the originals as ext4.
What can I do to get the videos as one file??

Re: File undelete with TestDisk

Posted: 08 Sep 2014, 06:38
by cgrenier
If the files were stored on an ext4 filesystem, when you run PhotoRec, you need to select "[ext] ext2/3/4", otherwise indirection blocks will not be detected.

Re: File undelete with TestDisk

Posted: 29 Mar 2016, 18:41
by Metallion
I saw somewhere in the internet that TestDisk 6.14 had an option to Undelete.
The actual version doesn't have it, at least, it seems that to me.

I'm trying to undelete some files that i had in my external disk (Mac formatted) with their original names.

I used the PhotoRec for a few days in a row, but lots of wavs, mp3, cpr, came corrupted.
(The wavs and mp3 higher than 10Mb usually are all corrupted)

Am i missing something?

Thanks in advance!

Re: File undelete with TestDisk

Posted: 06 Oct 2016, 05:10
by rktrcr
I was an idiot today. I was backing up audit log files on multiple rhel 6 workstations. I moved/copied/tar multiple files into a dir once all files needed for back up are there I mkisofs of these files. after I make the iso on the remote workstations I scp them to the workstation I am at. once I verified the size of the iso image I scp is the same as the original I rm all the files. I did this on all the machines and got keyboard happy and actually deleted the directory that contained all the iso images. I have powered down the computer to hopefully keep these files intact. Can I recover just the .iso files using test disk or photorec? or will I need to try and recover all the audit files then start over? I am weary of installing livedisk on the hard drive I want to recover these audit log. Which LiveCD works best with RHEL 6? Would a live CD be the best option? or just install on the hard drive and hope for the best?


Re: File undelete with TestDisk

Posted: 06 Oct 2016, 05:56
by cgrenier
You can use PhotoRec to recover the .iso. If needed, disable all other files in FIleOpts.