Recovering Ext4 In Sparse File

Using TestDisk to repair the filesystem
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
xavier23
Posts: 3
Joined: 22 Jul 2019, 21:54

Recovering Ext4 In Sparse File

#1 Post by xavier23 »

I have ext4 filesytem with metadata damaged. Running

Code: Select all

fsck -p /dev/sda1
may have been the reason (auto accept all fsck * dialogs -which may trim the inodes). After mounting the filesystem,

Code: Select all

ls
shows all subdirectories as empty.

I am not trying to recreate the inode but i need a few files. The one I need is ~ 50GB, a sparse file containing a ext4 file system, so I'll do a Data Carving looking for the '0xEF53' magic number (ext4 header) and then recover all the blocks following this.

I tried Testdisk but it only seem to file the main ext4 filesystem and not the sparse file containing ext4. So how may I search for ext4? Alternatively I may use PhotoRec but I also am confused how to find the sparse file an additionally the 50GB size may be problem.

Thank you for your advice!


* https://www.ibm.com/docs/en/aix/7.2?top ... ck-command

recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering Ext4 In Sparse File

#2 Post by recuperation »

Please post your log file.
Is your sparse file compressed?
xavier23 wrote: 13 Nov 2022, 18:33 I tried Testdisk but it only seem to file the main ext4 filesystem and not the sparse file containing ext4.
Testdisk's primary purpose is to find partitions. Partitions typically start with a bootsector whose content is not randomly shifted in relation to the sector boundaries.
Finding a magic number of a certain partition type anywhere is not sufficient to characterize that finding as a partition.

Locked