I used PhotoRec to recover my data form a disk, which has got fuxsocy attack and all directories and files became 0 length long. The system is Linux openSuSE 15.2.
The result was at the end:
Disk size: 2000 GB, partition size 3.736.xxx.xxx sectors (output disk size 8TB)
Pass 3 - Reading sector 77x.xxx.xxx/partition size
Recup_dirs: 323 , last recup dir number 323
Elapsed time: cca 250 hours (USB backup drive), estimated time cca. 1040 hours, total recovered files numbers already were cca 160k...
After that program went to 8 hours infinite cycle tried to write twice approx. same f77x.xxx.xxx.zzz file and at the end stopped, wrote an error message: no enough space to write output file and deleted the whole created directory... but there was enough free space to write.
Unsuccesful long journey
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
recuperation
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Unsuccesful long journey
Sorry, instead of answering I modified your initial post resulting in the deletion of the last part - if you have a backup you can restore it!
Which version?venember wrote: ↑25 Nov 2020, 17:19 I used PhotoRec to recover my data form a disk, which has got fuxsocy attack and all directories and files became 0 length long. The system is Linux openSuSE 15.2.
The result was at the end:
Disk size: 2000 GB, partition size 3.736.xxx.xxx sectors (output disk size 8TB)
Pass 3 - Reading sector 77x.xxx.xxx/partition size
Recup_dirs: 323 , last recup dir number 323
Elapsed time: cca 250 hours (USB backup drive), estimated time cca. 1040 hours, total recovered files numbers already were cca 160k...
After that program
How do you know?went to 8 hours infinite cycle tried to write twice
How would you know that?approx. same f77x.xxx.xxx.zzz file and at the end stopped, wrote an error message: no enough space to write output file and deleted the whole created directory... but there was enough free space to write.
Re: Unsuccesful long journey
version 7.1
I have seen this from the messages on the screen, always repeated the reading cycle an did not write anything onto the output disk.
I checked the change the record number in a repeated cycle which was lasted 8 hours, and the recovered file number.
Perhaps it is a reading counting problem, I checked the recup dirs' name and the record counter number, these are 77x.xxx.xxx, just 9 digits... if these are octal, it maybe a problem.
After the 77x.xxx.xxx the cycle was restarted.
The partition sector length is 10 digits.
------------------------
Moreover ALL the files were deleted on the output disk, when PhotoRec quitted... I do not know why. All my saved images before, everything...
I have seen this from the messages on the screen, always repeated the reading cycle an did not write anything onto the output disk.
I checked the change the record number in a repeated cycle which was lasted 8 hours, and the recovered file number.
Perhaps it is a reading counting problem, I checked the recup dirs' name and the record counter number, these are 77x.xxx.xxx, just 9 digits... if these are octal, it maybe a problem.
After the 77x.xxx.xxx the cycle was restarted.
The partition sector length is 10 digits.
------------------------
Moreover ALL the files were deleted on the output disk, when PhotoRec quitted... I do not know why. All my saved images before, everything...
-
recuperation
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: Unsuccesful long journey
Could you try version 7.2 WIP?venember wrote: ↑26 Nov 2020, 10:17 version 7.1
I have seen this from the messages on the screen, always repeated the reading cycle an did not write anything onto the output disk.
I checked the change the record number in a repeated cycle which was lasted 8 hours, and the recovered file number.
Perhaps it is a reading counting problem, I checked the recup dirs' name and the record counter number, these are 77x.xxx.xxx, just 9 digits... if these are octal, it maybe a problem.
After the 77x.xxx.xxx the cycle was restarted.
The partition sector length is 10 digits.
------------------------
Moreover ALL the files were deleted on the output disk, when PhotoRec quitted... I do not know why. All my saved images before, everything...
Brute force should be disabled.
How much free space is on the output disk?
Did Photorec delete other content than its own recovered files?!
Is the file system on the output disk OK?
Re: Unsuccesful long journey
"Moreover ALL the files were deleted on the output disk, when PhotoRec quitted... I do not know why. All my saved images before, everything..."
Sorry. After PhotoRec stopping the Linux detached the disk. Remount helped me, the files exist.
Tha PhotoRec did not delete files, including it's own.
I have 2,5 TB yet.
I will checked it again with the newer version, firstly I look for that in the openSuSE distribution. But it takes very long time...
Sorry. After PhotoRec stopping the Linux detached the disk. Remount helped me, the files exist.
Tha PhotoRec did not delete files, including it's own.
I have 2,5 TB yet.
I will checked it again with the newer version, firstly I look for that in the openSuSE distribution. But it takes very long time...
Re: Unsuccesful long journey
The saga continues.
1. I tried the newest version before Christmas. It was very useful and handy. During this I realized that my computer have had some memory errors... so I replaced my motherboard, memory, processor. It took a pair of weeks.
2. In the New Year I continued the recovery process. There were no errors what I wrote about before. Unfortunately the Testdisk did not realized the swap partition and destroyed that after the reboot. But it was no problem at the end.
3. I made some (2) partition recovery, resulted by Testdisk and PhotoRec. So I have now unpaired results: directory structures and filenames with 0 length and a bunch of dumped files with unidentified artificial names.The amount of files is more than 200k of one disk... How could I pair the directory structures and ewal filenames with the PhotoRec file contents? If I would try to pair them manually it would take several months...
Please help me.
1. I tried the newest version before Christmas. It was very useful and handy. During this I realized that my computer have had some memory errors... so I replaced my motherboard, memory, processor. It took a pair of weeks.
2. In the New Year I continued the recovery process. There were no errors what I wrote about before. Unfortunately the Testdisk did not realized the swap partition and destroyed that after the reboot. But it was no problem at the end.
3. I made some (2) partition recovery, resulted by Testdisk and PhotoRec. So I have now unpaired results: directory structures and filenames with 0 length and a bunch of dumped files with unidentified artificial names.The amount of files is more than 200k of one disk... How could I pair the directory structures and ewal filenames with the PhotoRec file contents? If I would try to pair them manually it would take several months...
Please help me.
-
recuperation
- Posts: 2735
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)