cgsecurity.org

Hello,
i was accidently delete files(with rm command, only files not folders).i was umount drive and make a clone disk then remount another system with readonly. (drive mount success)
After then scan with testdisk .ican see the files but 0 file size(all red).so i cant copy to another drive.
i was advanced=> select first linux partition (pic 1) => for useing Superblock (it says you must repair the file system) pic2=> then i was repair file system
fsck.ext4 -p -b 32768 -B 4096 /dev/sdc1 fix all problems then restart, check with testdisk, noting happends all files is red with size 0
iwas try this with all superblocks
i dont want to recover with photorec because drive has alot of files and folder, i cant reorganize them.

disk was old first use for windows (so has ntfs partition) then delete al partition install a debian system, then clean all and repartition with ext4 for use samba share
debian 9 64 bit
drive is single partition
ext4 format
use for samba shares
type Intel (testdisk automaticly chose)

/dev/sda main system disk
/dev/sdb use for restore files
/dev/sdc problem disk (delete files disk)

testdisk report is here http://yedek.parlakpixel.com/testdisk.log

please help me.

regards,

Extract from https://www.cgsecurity.org/testdisk.pdf
"With ext3 and ext4, it's possible to find the names of the deleted files but the location of the deleted data isn't available anymore, so even if ext3/ext4 is similar to ext2, it's not possible to recover lost files using TestDisk."
PhotoRec is the only way to recover your deleted files and yes, it's hard to sort the recovered files without the original filenames.

thanks for the answer.
can we say, ntfs is more recoverable partition than the ext partitions?

Hello jalapela,

can we say, ntfs is more recoverable partition than the ext partitions?

after reading what cgrenier said with respect to extX file systems I would say
that you are right with your assumption as far as undeleting of files is concerned.

In NTFS the file is marked as "deleted" and the assigned clusters are freed.
Name an involved clusters are kept until the MFT entry for the file name is overwritten.

You just have the risk that the freed clusters are being overwritten by other files in the meantime or that NTFS needs the deleted file entry.
As long as the file entry ist still there in NTFS you are in a better position than with extX.

I have no clue for other recovery scenarios though.