cgsecurity.org

Hi,

I have a case where I try to restore an overwritten ogg/mp3 file on ext4. It looks like photorec is not recognizing my files so I tried to upload two files
http://www.railers.fi/audio/rpdr2.mp3
http://www.railers.fi/audio/rpdr2.ogg
but all I got was an error "too big". Both files weight some 4MB.
Is it possible to test photorec's ability to see these files?

BR,
Timo

PhotoRec can recover both files. It's possible to recover deleted files but not overwritten files. If the content has been overwritten, it's gone. Copy On Write (COW) filesystem will change that in the future.

Thank You for your fast response!
Background of my case is here
Those 2 4MB files were from an earlier test broadcast. Why I ask is that using photorec with "whole partition" option, it didn't recognize the valid 55MB mp3 file I can see in the filesystem. Photorec did recover loads of other mp3/ogg files but not the overwrite-produced ~55MB ogg & mp3 files I would have expected.

The actual files I am after were approximately 300MB of mp3 data and 300MB of ogg data.
What happened was that after 6h of recording at 128kpbs the recorder process started to write same file for 57 minutes/55MB. I know I have permanently lost the first 57 minutes of the show but for the remainder I still keep up a little hope.

Knowing that there are the bytes for the remaining ~250MB somewhere (6h of broadcast approx 300MB and assuming the recording process started from beginning and same sectors as the original 300MB file, I would have lost 57 minutes of it and should have 5h 3mins lying somewhere).
Do you think this kind of partial 250MB is recoverable by PhotoRec?

BR,
Timo