Not understanding undelete basics: ext4

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
nmdaster1
Posts: 2
Joined: 29 May 2013, 02:49

Not understanding undelete basics: ext4

#1 Post by nmdaster1 »

I'm trying to recover recently deleted files from an ext4 partition. When I try to select this partition, I don't see "Undelete" as an option. Here's what I've tried:

1. selecting /dev/sda, which selects EFI as the default filesystem

Code: Select all

Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 13 TB / 12 TiB - DELL PERC 6/i
 Disk /dev/mapper/hanserver2-home - 13 TB / 12 TiB - DELL PERC 6/i
 Disk /dev/mapper/hanserver2-root - 95 GB / 89 GiB - DELL PERC 6/i
 Disk /dev/mapper/hanserver2-swap_1 - 4110 MB / 3920 MiB - DELL PERC 6/i
2. Select "Advanced"

Code: Select all

Disk /dev/sda - 13 TB / 12 TiB - CHS 1701937 255 63

     Partition                  Start        End    Size in sectors
  1 P Unknown                     2048       4095       2048
  2 P MS Data                     4096     503807     499712
> 3 P Linux LVM                 503808 27341617151 27341113344
...
 [  Type  ] >[Image Creation]  [  Quit  ]
I do see "undelete" if I select the "MS Data" partition, but that isn't where my data is/was.

I've also tried the selecting the "home" location in the first list (/dev/mapper/hanserver2-home). This selects "[None]" as the filesystem. When I then go to "Advanced" for this drive, I see:

Code: Select all

Disk /dev/mapper/hanserver2-home - 13 TB / 12 TiB - CHS 1376002051 1 1

     Partition                  Start        End    Size in sectors
>   P ext4                           0 27145805823 27145805824
...
 [  Type  ]  [Superblock] >[  List  ]  [Image Creation]  [  Quit  ]
Again no "[Undelete]". If I choose "List", I can browse that filestructure and see a bunch of files, but some of which were deleted long ago (and marked in "red"), but I don't find the files that were JUST deleted. I even tried "select all" and "copy all selected" (to a different drive), but this didn't restore the ones I'm trying to find.

Am I doing something wrong? Why might my most recent deletions not be in here?

DSpider
Posts: 23
Joined: 29 Jul 2013, 10:41

Re: Not understanding undelete basics: ext4

#2 Post by DSpider »

Hi,

There is a post of "cgrenier" (which is the designer of Testdisk) in this forum which tells that Testdisk does'nt work with ext4 partitions, and to try photorec to recover individual files.

Locked