Awsome crash .. help requested

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
forstera
Posts: 2
Joined: 24 Nov 2016, 09:32

Awsome crash .. help requested

#1 Post by forstera »

Hello all,

I'm just in nightmare... I dont write the full history but in short, I tried to recover deleted data on a linux server in a virtual machine and LVMs. I used Testdisk and send the result to an external NAS. After 1 day I realized my NAS was full of data..
When I had a look on the recovery structure, I realized that some files were now directories and inside these 'new' directories was a part of the structure (file and folders) of my server ! And this hundreds of times ..
For the while, I've no explication on this.. so if someone has an idea to help me understand :)

Second part of the problem : so I decided to start the recovery once more but folder after folder but I had first to emply my nas. I began to delete a few files and checked my server was fine . then I delete afew folders and made a new check.. everything was fine on my server. Finally I started a full delete on my nas. Everything was running fine but suddendly, (this is the second part I dont understand) while deleting on my NAS it was deleting on my server, too !
So I lost working files but the whole structure of /var of my server !! so after a while I could not even access it ..

So I stopped it and made a mistake, tried to restart it (in some forums, some said maybe it was just my LVM which was locked and restarting was going to solve the the problem) .. but while restarting, my linux checked that /var was missing and created a new /var folder..but nothing more.

Now, I restarted my server with a rescue disk, made a copy of my harddrive using the 'dd' command. I'm working yet on that copy and I'm trying to recover the files that were under the /var folder but as it has been recreated , testdisk cannot see the missing structure (inside it I had my working datas, thousands of files)...
So If someone has an idea I can try, it's really really welcomed :)

Thanks to all

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Awsome crash .. help requested

#2 Post by cgrenier »

Did you copy files using TestDisk or did you use PhotoRec ?
For deleted files from ext3/ext4 or xfs filesystem, your actual problem, you can use PhotoRec to recover them. They will not have their original filenames or directory structure.

forstera
Posts: 2
Joined: 24 Nov 2016, 09:32

Re: Awsome crash .. help requested

#3 Post by forstera »

Hello,
Thanks for your answer :) I first use Testdisk but it did not find my file. I'm going to use now Photorec because the folder structure has been damaged. Do you have an idea on what happened when I first made a testdisk (some files were suddendly seen as folders ) ?

Thanks for your helpe

Locked