cgsecurity.org

Ok Remy...

the process start to show me some different lines now...


TestDisk 6.14-WIP, Data Recovery Utility, May 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/mapper/ssim_vol_storagearchive-storagearchive - 7516 GB / 6999 GiB - CHS 14679949312 1 1
Analyse cylinder 2644803584/1795047423: 47%


Invalid FAT boot sector
0 D FAT32 LBA 839176087 3643466118 2804290032
FAT32 LBA 839176087 3643466118 2804290032
Invalid FAT boot sector
0 D FAT16 LBA 4952136021 6939545034 1987409014
FAT16 LBA 4952136021 6939545034 1987409014

FAT32 1.5TB ??? false positive, or you forgot to told me something...
Or perhaps detection of older filesytem on the disks you just add, for example you could have had a "very big" FAT32 space on a raid volume (raid5 with 4 disk of 5GB ?)
Or your LVM was splitted in several LV, but testdisk should have recover these LV also.

remy wrote:FAT32 1.5TB ??? false positive, or you forgot to told me something...
Or perhaps detection of older filesytem on the disks you just add, for example you could have had a "very big" FAT32 space on a raid volume (raid5 with 4 disk of 5GB ?)
Or your LVM was splitted in several LV, but testdisk should have recover these LV also.

Where do you saw this information?
I really don't know!

In the LV that I need to recovery I just have 4 PV's with 512Gb each, but this LV was increased to 7TB and I don't want to include and exclude the disks more and more times.

I am running the testdisk in the 7Tb volume...

I am expecting that when the "analisys" finish, I can see the files and then try to do something...Am I correct?

FAT32 begins sector 839176087, ends sector 3643466118, size = 2804290032 sectors.
2804290032 * 512 = 1435796496384 bytes. = 1.44TB

Hi Remy,

I did all changes that you told me to do and started the process again!
Look at this picture the actual status?
Do you believe that this is the correct cenario?

Thank you very much!

Moacir Faria

It looks still like false positive detections. Do you know what was your filesystem embedded in your LV before ?

remy wrote:It looks still like false positive detections. Do you know what was your filesystem embedded in your LV before ?

vfs

Do you have some tip?

Thank you!

MF

I'm afraid that trying to recover filesystem structure will be time loosing. Did you have results with photorec ? What is the kind of files that you are looking for ?

remy wrote:I'm afraid that trying to recover filesystem structure will be time loosing. Did you have results with photorec ? What is the kind of files that you are looking for ?

I'm afraid too! Yes, I did some results with photorec, but I can't receive all files and the files that I received was without the correct names.

I have 6 types of files in this archive (edx, key, vdx, sar, ndx, tdx).

Photorec did a recovery of a lot of files but, all of them, without a name and probably only the text files and 2 or 3 big files that came with another extension

I really need to try to recovery this filesystem structure because without it I believe that the files don't make any sense.

Thank you for your help and attention... if you have more tips I will really appreciate.

MF

Sorry, no more idea with testdisk or photorec usage...