txt files from a btrfs partition overwritten by etx4 Topic is solved

[Bess2506]

hello
please I find myself in a horrible situation because of a succession of stupid manipulations and I really find myself back to the wall you are literally my only hope, please help me
I am looking to recover 4 .txt files from a Btrfs partition overwritten by another installation in Ext4
I spent the last few days looking for a solution, so I was able to understand that Btrfs & especially .txt it's almost an impossible mission
but please if there is a glimmer of hope, or any method (even unconventional) please don't hesitate to save me,........
I will try to detail as much as possible to give you the most informations.
so excuse me if any information seems unnecessary or intuitive (and certainly the length of the post)

1 the situation t0 is represented as the joint capture
(the computer is used before but this point is the beginning of the problem / disaster)

a Fedora 36 installation (updates from Fedora 31 without formatting) on the large partition (and which also contains the files that I am looking to recover) + almost 100 Gb empty NTFS (out of problem)

t1 a Windows 10 installation in the NTFS partition (and the beginning of the nightmare)

the installation goes well and windows starts normally and everything goes well, except that no Grub the boot goes directly to windows without choice
I understood that windows crashed the fedora startup so I fiddled a bit with EasyBCD from windows without success
I then head to a fedora DVD hoping to use the recovery option or something similar
but the DVD was Fedora 33 and not 36 since I only use automatic updates
up to this point it was possible for me to copy all that I want using the live DVD, just the startup which does not launch I could even have updated fedora without losing the data since it I've been doing this for years with no problem
the stupid ideas start so I change the dvd to a LinuxMint DVD just because gparted is installed by default (to save 60 seconds I lost a week in hell so far)
I start LinuxMint and I guess because of the habit with fedora I follow the "next" "next" ……without paying attention neither to the filesystem nor even to the warning and I restart and voila.... .
overwritten everything (even the windows partition) t2


here I literally lose my head and I start looking everywhere and sinking even more with each movement
I booted on a live dvd and launched Testdisk ( after installing windows in a space almost equivalent to the old NTFS partition )

while consulting everything I find on the net related to my problem and each time I discover information that makes me even more nervous and therefore more stupid
I discover that TestDisk/Photorec does not detect the Btrfs but in desperation I choose to try my luck and I press P when testdisk captures a small part of what seems to be a Btrfs partition (inspired by an answer to a similar problem in this forum despite it being clearly stated that it has nothing to do with Btrfs)
I perform a restart still live dvd the result will be this t3:

since my goal was not to recover the partition but some documents in it
I stupidly try to access and of course it is empty
I then stupidly extend the part recovered by TestDisk on the entire partition which was before Fedora before (hoping to "trick" commercial software which presents itself as very powerful and only works on windows (just because isee Btrfs presents on their site)
the situation then becomes like this t4

so I launch the software ( windows ) which marks the partition in Raw
after 17 hours he finds me almost 300 gb of files of all types and even from before the 1st installation except what the .txt files are looking for (neither new nor old)
I therefore return to live DVD and I launch photoRec, although in the meantime I have been able to understand that txt files are a waste of time
but by consulting some interventions in this forum (and by seeing .txt in the options of Photorec) I said to myself that since txt exists in the options it is that there is always a chance to recover my files
the problem that btrfs does not exist in the choice of the file system I then carry out a search with the Intel options - system Linux Etx3/Etx4........file type txt
but I can't find the 512 choice that I think I see in an answer on the text search I continue without
PhotoRec takes 7 hours to search and finds me 31.5 GB of txt files and almost 2 million files

(please imagine my situation if I am willing to search that size)

I did a search with grep which took a few hours without result (it skips a line)



Here is the end of the story, which I hope:
1. I still keep the photoRec research folder but I think the files are actually of another type (I saw a few and think they are html and ph etc... not . txt actually)
==> do you think I can change something in the grep search (maybe it didn't complete the search - despite I didn't see any error message or something that says the search did not complete successfully ) and repeate ???

2. if it is certain that this folder does not contain anything of what I am looking for - can I change something in the Photorec parameters to ensure a better result ??? knowing that the only positive point in this whole story is that I remember a few words in the txt files (out of 4 files I know the start of 3 of them and a few words inside the other but not at the start)

3.I've seen comments that talk about "scalpel" and that it's possible if you know the beginning and estemate size of the file ...

please I am not techno at all, can someone explain to me how to do with this tool as a last resort (if there is no manipulation possible with Photorec and the Btrfs/txt combination or any what other solution (with the simplest vocabulary and the most detail please - the documentation which speaks of “scalpel” that I consulted resembles black magic for me I did not understand anything)

and of course if there is no way to go back (cancel TestDisk intervention and Linux Mint installation) ==> I ask for a miracle I know
but I don't want to find the fedora installation nor make it work just find the first partition (not working but in the right file system) to maybe look for a recovery software that can see a correct system so can searsh (if it exists)
if not one of the above points PhotoRec / Scalpel (I am ready to search in several files if there is a chance)

because of nightmare I realize the importance of your precious work
I thank you very much and I wish you all the happiness (you really deserve it)

Disk HDD 600Gb
Bios Legacy
I'm just looking for the 4 txt files all the rest is not important
I remember a few words inside the files (and I am ready to repeat several times if necessary
don't let me down please help me out of this nightmare… thank you so much & sorry

[recuperation]

Thanks for posting such an extensive documentation.

The following is beyond supporting Photorec.

You might have mentioned the assumed length of your text file because the length determines how many resources your file in terms of sectors or clusters was using. You did not say if encryption was involved.
Furthermore it will be interesting to know if your txt file was ASCII or unicode.

If you fail to pull your keywords out of what you recovered using Photorec you can search manually using a hex editor.
Use a simple USB stick, format it using BTRFS and put similar txt files on that newly formated BTRFS partition.
Use any hex editor that opens up devices as well to search your keywords. If you do not manage to find your keywords that are contained in your txt files that you put there for testing purposes you won't make it with your real case.

If you fail, any computer geek should be able to help, a professional recovery lab is a waste of ressources as they are more hardware-oriented.

[Bess2506]

Thanks for posting such an extensive documentation.

The following is beyond supporting Photorec.

You might have mentioned the assumed length of your text file because the length determines how many resources your file in terms of sectors or clusters was using. You did not say if encryption was involved.
Furthermore it will be interesting to know if your txt file was ASCII or unicode.

If you fail to pull your keywords out of what you recovered using Photorec you can search manually using a hex editor.
Use a simple USB stick, format it using BTRFS and put similar txt files on that newly formated BTRFS partition.
Use any hex editor that opens up devices as well to search your keywords. If you do not manage to find your keywords that are contained in your txt files that you put there for testing purposes you won't make it with your real case.

If you fail, any computer geek should be able to help, a professional recovery lab is a waste of ressources as they are more hardware-oriented.

Thank you very much for your answer
the documents are .txt files created by gedit (under fedora) without changing the default settings
there is actually something to do with the encoding (I think I need to research a bit and know ASCII or unicode) -- that point is OK I think-because I remember when I open one of files in windows it asks me what software should I use to open before notpad is the default player for that file (so the encoding is different from the windows default).

You did not say if encryption was involved.

if you mean if the disk was encrypted
the answer is No (a simple installation without hard disk encryption just a password requested at the opening of the session)

account searching by name and 'hexadecimal ' that's exactly what I didn't get when I tried to do a search (and I've seen people talking about scalpel). but I guess some further research should help me

the files do not exceed a few lines (simple text no code or nothing) (the largest less than 200-300 lines max)
these are accounts - addresses - passwords that literally contain "MY LIFE" (you understand why I'm afraid to consult "a Geek"

you haven't said if this search I have to do with the hexadecimal editor it concerns the folder that I extracted by Photorec (I'm not sure yet that Photorec was well adjusted and got me the right files or not ) - or is it a direct search on the disk (/ image) - or do I have to restart a Photorec search or another tool (knowing that Photorec was not "regulated" on Btrfs /it does not exist and that a parameter suggested in this forum - 512 - was not put during the search)

no problem I think you will give me the road to follow and I will do some research to understand what I have to do (the format the flash part is the clearest .....)

I will put the result (after a certain time I think)

I salute your honorable work and appreciate your availability
thank you

[recuperation]

Use any hex editor that opens up devices as well to search your keywords.

[Bess2506]

the method worked
I was able to recover several versions, a little old, of the documents, I think they are from before the Btrfs installation but it worked
thank you very much for your precious help
merci infiniment

[recuperation]