need help for deleted files

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
jalapela
Posts: 2
Joined: 14 Mar 2019, 05:25

need help for deleted files

#1 Post by jalapela »

Hello,
i was accidently delete files(with rm command, only files not folders).i was umount drive and make a clone disk then remount another system with readonly. (drive mount success)
After then scan with testdisk .ican see the files but 0 file size(all red).so i cant copy to another drive.
i was advanced=> select first linux partition (pic 1) => for useing Superblock (it says you must repair the file system) pic2=> then i was repair file system
fsck.ext4 -p -b 32768 -B 4096 /dev/sdc1 fix all problems then restart, check with testdisk, noting happends all files is red with size 0
iwas try this with all superblocks
i dont want to recover with photorec because drive has alot of files and folder, i cant reorganize them.

disk was old first use for windows (so has ntfs partition) then delete al partition install a debian system, then clean all and repartition with ext4 for use samba share
debian 9 64 bit
drive is single partition
ext4 format
use for samba shares
type Intel (testdisk automaticly chose)

/dev/sda main system disk
/dev/sdb use for restore files
/dev/sdc problem disk (delete files disk)

testdisk report is here http://yedek.parlakpixel.com/testdisk.log

please help me.

regards,
Attachments
pic2.JPG
pic2.JPG (60.67 KiB) Viewed 2803 times
pic1.JPG
pic1.JPG (48.26 KiB) Viewed 2803 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: need help for deleted files

#2 Post by cgrenier »

Extract from https://www.cgsecurity.org/testdisk.pdf
"With ext3 and ext4, it's possible to find the names of the deleted files but the location of the deleted data isn't available anymore, so even if ext3/ext4 is similar to ext2, it's not possible to recover lost files using TestDisk."
PhotoRec is the only way to recover your deleted files and yes, it's hard to sort the recovered files without the original filenames.

jalapela
Posts: 2
Joined: 14 Mar 2019, 05:25

Re: need help for deleted files

#3 Post by jalapela »

thanks for the answer.
can we say, ntfs is more recoverable partition than the ext partitions?

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: need help for deleted files

#4 Post by recuperation »

Hello jalapela,
can we say, ntfs is more recoverable partition than the ext partitions?
after reading what cgrenier said with respect to extX file systems I would say
that you are right with your assumption as far as undeleting of files is concerned.

In NTFS the file is marked as "deleted" and the assigned clusters are freed.
Name an involved clusters are kept until the MFT entry for the file name is overwritten.

You just have the risk that the freed clusters are being overwritten by other files in the meantime or that NTFS needs the deleted file entry.
As long as the file entry ist still there in NTFS you are in a better position than with extX.

I have no clue for other recovery scenarios though.

Locked