photorec finds headers but no files

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
hbivort
Posts: 2
Joined: 13 Feb 2024, 01:06

photorec finds headers but no files

#1 Post by hbivort »

I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.

I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.

Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.

I booted from a live Ubuntu USB run test, but no information came out of that.

Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.

Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.


Any help will be appreciated, thank you.
Top
recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: photorec finds headers but no files

#2 Post by recuperation »

> Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.

Incomprehensible, please explain.
Thank you!
Top
hbivort
Posts: 2
Joined: 13 Feb 2024, 01:06

Re: photorec finds headers but no files

#3 Post by hbivort »

I am running photorec, pass 0 finishes in 5 minutes and finds a number of headers.
Pass 1 and 2 fail to find any files ( screen says zero files)

For reference this is the output

<dfxml xmloutputversion="1.0">
<metadata xmlns="http://www.forensicswiki.org/wiki/Categ ... ensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.1</version>
<build_environment>
<compiler>GCC 11.2</compiler>
<library name="libext2fs" version="1.46.5"/>
<library name="libewf" version="none"/>
<library name="libjpeg" version="libjpeg-turbo-2.1.1"/>
<library name="libntfs" version="libntfs-3g"/>
<library name="zlib" version="1.2.11"/>
</build_environment>
<execution_environment>
<os_sysname>Linux</os_sysname>
<os_release>5.15.0-43-generic</os_release>
<os_version>#46-Ubuntu SMP Tue Jul 12 10:30:17 UTC 2022</os_version>
<host>ubuntu</host>
<arch>x86_64</arch>
<uid>0</uid>
<start_time>2024-02-12T19:54:18+0000</start_time>
</execution_environment>
</creator>
<source>
<image_filename>rescue.img</image_filename>
<sectorsize>512</sectorsize>
<image_size>2000398934016</image_size>
<volume>
<byte_runs>
<byte_run offset="0" img_offset="0" len="2000398934016"/>
</byte_runs>
</volume>
</source>
<configuration> </configuration>
<fileobject>
<filename>f0000002.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1024" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037056.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="18972672" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037120.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19005440" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f4193792.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="2147221504" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f12581376.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="6441664512" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f20968960.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="10736107520" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f29356544.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="15030550528" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f37744128.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19324993536" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f104844800.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="53680537600" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f113232384.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="57974980608" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f205495808.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="105213853696" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f339697152.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="173924941824" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f524224000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="268402688000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1019091456.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="521774825472" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1438470656.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="736496975872" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f2621120000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1342013440000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f3057274368.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1565324476416" len="512"/>
</byte_runs>
</fileobject>
</dfxml>
Top
recuperation
Posts: 2737
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: photorec finds headers but no files

#4 Post by recuperation »

You did not define what "header" means with regards to Photorec. Given your information I was able to guess what you were refering to.
hbivort wrote: ↑13 Feb 2024, 01:20 I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.
In case of problems, running ddrescue is typically the best choice to preserve the status quo.
I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.

Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.

I booted from a live Ubuntu USB run test, but no information came out of that.
The TestDisk log file is the source of information in the TestDisk world. I don't know what a "Ubuntu USB run test" is. Your statement suggests that your NVME SSD was connected externally. That piece of information belongs into your initial case description case as your interface could be the culprit. I am not using this NVME stuff. If your mainboard has slots where they can be used I would use that different interface, otherwise I would use another third interface. You would need to exclude the interface as a possible source of error.

Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.
That is a very bad sign.

Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.
Geometry information is legacy stuff that is not needed on modern operating systems and I pretend this applies to modern Apple computers as well.

Any help will be appreciated, thank you.
Bring your NVME to a professsional lab if your NVME interface is not the culprit and restore your backup - it is pretty good that you have one at least!
Top
Ushavilash
Posts: 5
Joined: 12 Mar 2024, 07:55

Re: photorec finds headers but no files

#5 Post by Ushavilash »

hbivort wrote: ↑13 Feb 2024, 01:20 I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.

I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.

Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.

I booted from a live Ubuntu USB run test, but no information came out of that.

Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.

Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.


Any help will be appreciated, thank you.

Hey hi, sorry but have you attempted to recover your files using alternate software or method beside Photorec?
Top
Post Reply

Return to “Partition Recovery”