File undelete - seems to get stalled on garbage files - possibility to script?

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
dapp
Posts: 3
Joined: 30 Dec 2016, 22:41

File undelete - seems to get stalled on garbage files - possibility to script?

#1 Post by dapp »

Hi all,

first of, thank you very much for this amazing software! From what I can tell it works much better than the commercial programs that I have tested.

I am trying to recover some files that were unintentionally deleted on an exFAT partition using a Macintosh; I suspect there was some form of a file system problem, as those files were marked as deleted without actively deleting them. When I scan the disk with testdisk I can see all the lost files show up in the list marked as deleted, and I can also successfully restore them. The catch is that there are numerous levels of subfolder to every folder. If I select a folder, testdisk will successfully undelete a number of files but then get into an endless loop of failures of what I think is reading data garbage and potentially some loops; files were moved around a lot before. If I select files manually there is no failure, but it takes a huge amount of time.

Is there any way of specifying rules for undeletion of files, similar to the way PhotoRec works? I tried PhotoRec but end up with approx. 24 folder of files, and it does not restore the file structure I had before. Maybe it might be enough to tell testdisk to skip certain types of files - because when looking at the file structure in testdisk as a human it is not hard to discern which are the files I want to restore, and which is garbage. To me, the scripting information on http://www.cgsecurity.org/wiki/Scripted_run was not clear in this regard.

Alternatively is there any other way of running undelete on a folder so that it does not get caught up in such loops or failures?

I hope I was able to describe my problem somewhat clearly - I can post the log files and/or screenshots if you think it might help.

Thanks and best regards!
Goetz

dapp
Posts: 3
Joined: 30 Dec 2016, 22:41

Re: File undelete - seems to get stalled on garbage files - possibility to script?

#2 Post by dapp »

Hi, I wanted to reach out again and see if somebody can help me with this problem. I can send/post a log file if necessary.

Is there any way I can restore a folder/subfolder-structure without it ending in endless loops? When I try marking a folder that contains subfolders, testdisk will restore a number of files and report success, and then end seems to reach a state of just producing thousands of failures. I have let it run for several hours and it seems not get anywhere, at which point I stopped it.

In order to avoid potential damage to the original harddrive I used a 1:1 copy that I created using ddrescue.

What solutions would you propose? Is the solution to let it run for dozens of hours and just see what happens, or do you have any idea what might be going on?

Thanks!

dapp
Posts: 3
Joined: 30 Dec 2016, 22:41

Re: File undelete - seems to get stalled on garbage files - possibility to script?

#3 Post by dapp »

Hi all,

I'm following up on this as we are still having problems. Interestingly enough, testdisk seems to be able to achieve results that other commercial software cannot, so big kudos to you!!

Is there any way we can script testdisk to undelete a specific file in an exFAT filesystem, or rather, make it run through a list of files to recover? We created a log file using the instructions provided (Analyse, Quick Search and next Deeper Search) and have a list of files we would like to restore. The file system is exFAT, and I have attached a section of the log file - the file itself is very big (~1GB).

There are a number of files that are clearly garbage, and lots of the following errors
characterexfat_ucstoutf8: iconv failed Invalid or incomplete multibyte or wide
We also see damaged files such as
Can't create file [...]//K!å4­1¶ð[ˆ´®/哺❇誓ឝ㛜逴訤龄òŸˆ§ë·¢å¶™ê›‡ô®Ùœ­E­´Š( //¤5gV²×¬D½)Üa///'öJÓ,3ï»bi\"i/?¯£‡uïI¹1q[Ò3¤/᝜ﵥ塾엖玡흝宅씖窡흞붕恱헗櫭/၀ඔ㨌瓏́၁ㄴ䀅꒏།큃င䓵푑︘/ಕ鱽潬言睻¢耀耀挀ꆝ焇墫鹫狢////§ã±ºê«µï•€äª¾çª¡ä±£áµ¬ç‘¶è—¯ìª°á»¨ï®¿è–‚骋㫤⫁呴뎢ኹ觨ꋈଥ牰ﻣ垣꿲//䍦戼㔼㙚匲㐴ⱎ䐭ⴭ⭃㸩┧⠹㤦ℤ///讕⯞逓鿘ꑸ﫽儁ᷡ㼮埅ㆬ⿴鵿祉愹뚢폇멲喩毞즹辩˰愎稳Ჾ/䕅䍃㹃㸾㨺㠺㠸㌳ㄳㄱ⼯ⰯⰬ⼯㘯//䅁€ã¹€ã¸¾ã¸¾ã¸¾ã¸¾ã°¼ã¨¼ã¨ºã¨ºã¨ºã¨ºã ¸ã ¸//댻苆୤獠孴燢꾼떐딶ჺ砇쉋␀//Ñó â•`VµÛãã1Šà°¶è³Žë¹˜ì½¿îˆ”⾗ᒚ圚䶸ੳ鏠엁契扛튊ﯭꚥ侜㒢ᔟꡁ蘢ᄼ㎐ﳉꉫ褗ʡ//勰핞蕫ꌅ侀웵处냓쑻뤶硍夢/蕪䛞⬝⿪㺅謚黃訝櫗袙䜆鈃譫鿽/ᨋ큛苘ᛆ똴娀寰썿栣﹘쩗函彸狷뽶/æѤù_îGß@Ã/////////////

as well as files that are detected as 0 bytes or as larger as the actual partition.

While we can recover individual files when selecting them manually, these damaged files seem to cause testdisk to stall when trying to recover a whole directory. Doing it manually, in turn, takes an insane amount of time. I am sure the log file will tell you more than it did me, and we are hoping that you can provide us with some suggestions. We are hoping that it might be possible to use the log file to create a script that undeletes the specific files (I did not include those in the attached log file excerpt).

We would very much appreciate if you could provide us with some feedback if this is possible. We can also discuss this via PM or email, if you prefer.

Thanks!
Attachments
Testdisk_Log_Extract.zip
(2.51 KiB) Downloaded 312 times

Locked