cgsecurity.org

I have ext4 filesytem with metadata damaged. Running may have been the reason (auto accept all fsck * dialogs -which may trim the inodes). After mounting the filesystem, shows all subdirectories as empty.

I am not trying to recreate the inode but i need a few files. The one I need is ~ 50GB, a sparse file containing a ext4 file system, so I'll do a Data Carving looking for the '0xEF53' magic number (ext4 header) and then recover all the blocks following this.

I tried Testdisk but it only seem to file the main ext4 filesystem and not the sparse file containing ext4. So how may I search for ext4? Alternatively I may use PhotoRec but I also am confused how to find the sparse file an additionally the 50GB size may be problem.

Thank you for your advice!


* https://www.ibm.com/docs/en/aix/7.2?top ... ck-command

Please post your log file.
Is your sparse file compressed?

xavier23 wrote: 13 Nov 2022, 18:33 I tried Testdisk but it only seem to file the main ext4 filesystem and not the sparse file containing ext4.

Testdisk's primary purpose is to find partitions. Partitions typically start with a bootsector whose content is not randomly shifted in relation to the sector boundaries.
Finding a magic number of a certain partition type anywhere is not sufficient to characterize that finding as a partition.