I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.
I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.
Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.
I booted from a live Ubuntu USB run test, but no information came out of that.
Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.
Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.
Any help will be appreciated, thank you.
photorec finds headers but no files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
- Posts: 2752
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: photorec finds headers but no files
> Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.
Incomprehensible, please explain.
Thank you!
Incomprehensible, please explain.
Thank you!
Re: photorec finds headers but no files
I am running photorec, pass 0 finishes in 5 minutes and finds a number of headers.
Pass 1 and 2 fail to find any files ( screen says zero files)
For reference this is the output
<dfxml xmloutputversion="1.0">
<metadata xmlns="http://www.forensicswiki.org/wiki/Categ ... ensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.1</version>
<build_environment>
<compiler>GCC 11.2</compiler>
<library name="libext2fs" version="1.46.5"/>
<library name="libewf" version="none"/>
<library name="libjpeg" version="libjpeg-turbo-2.1.1"/>
<library name="libntfs" version="libntfs-3g"/>
<library name="zlib" version="1.2.11"/>
</build_environment>
<execution_environment>
<os_sysname>Linux</os_sysname>
<os_release>5.15.0-43-generic</os_release>
<os_version>#46-Ubuntu SMP Tue Jul 12 10:30:17 UTC 2022</os_version>
<host>ubuntu</host>
<arch>x86_64</arch>
<uid>0</uid>
<start_time>2024-02-12T19:54:18+0000</start_time>
</execution_environment>
</creator>
<source>
<image_filename>rescue.img</image_filename>
<sectorsize>512</sectorsize>
<image_size>2000398934016</image_size>
<volume>
<byte_runs>
<byte_run offset="0" img_offset="0" len="2000398934016"/>
</byte_runs>
</volume>
</source>
<configuration> </configuration>
<fileobject>
<filename>f0000002.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1024" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037056.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="18972672" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037120.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19005440" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f4193792.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="2147221504" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f12581376.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="6441664512" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f20968960.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="10736107520" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f29356544.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="15030550528" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f37744128.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19324993536" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f104844800.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="53680537600" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f113232384.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="57974980608" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f205495808.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="105213853696" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f339697152.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="173924941824" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f524224000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="268402688000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1019091456.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="521774825472" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1438470656.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="736496975872" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f2621120000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1342013440000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f3057274368.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1565324476416" len="512"/>
</byte_runs>
</fileobject>
</dfxml>
Pass 1 and 2 fail to find any files ( screen says zero files)
For reference this is the output
<dfxml xmloutputversion="1.0">
<metadata xmlns="http://www.forensicswiki.org/wiki/Categ ... ensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.1</version>
<build_environment>
<compiler>GCC 11.2</compiler>
<library name="libext2fs" version="1.46.5"/>
<library name="libewf" version="none"/>
<library name="libjpeg" version="libjpeg-turbo-2.1.1"/>
<library name="libntfs" version="libntfs-3g"/>
<library name="zlib" version="1.2.11"/>
</build_environment>
<execution_environment>
<os_sysname>Linux</os_sysname>
<os_release>5.15.0-43-generic</os_release>
<os_version>#46-Ubuntu SMP Tue Jul 12 10:30:17 UTC 2022</os_version>
<host>ubuntu</host>
<arch>x86_64</arch>
<uid>0</uid>
<start_time>2024-02-12T19:54:18+0000</start_time>
</execution_environment>
</creator>
<source>
<image_filename>rescue.img</image_filename>
<sectorsize>512</sectorsize>
<image_size>2000398934016</image_size>
<volume>
<byte_runs>
<byte_run offset="0" img_offset="0" len="2000398934016"/>
</byte_runs>
</volume>
</source>
<configuration> </configuration>
<fileobject>
<filename>f0000002.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1024" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037056.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="18972672" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037120.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19005440" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f4193792.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="2147221504" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f12581376.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="6441664512" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f20968960.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="10736107520" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f29356544.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="15030550528" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f37744128.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19324993536" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f104844800.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="53680537600" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f113232384.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="57974980608" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f205495808.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="105213853696" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f339697152.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="173924941824" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f524224000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="268402688000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1019091456.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="521774825472" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1438470656.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="736496975872" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f2621120000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1342013440000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f3057274368.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1565324476416" len="512"/>
</byte_runs>
</fileobject>
</dfxml>
-
- Posts: 2752
- Joined: 04 Jan 2019, 09:48
- Location: Hannover, Deutschland (Germany, Allemagne)
Re: photorec finds headers but no files
You did not define what "header" means with regards to Photorec. Given your information I was able to guess what you were refering to.
In case of problems, running ddrescue is typically the best choice to preserve the status quo.
The TestDisk log file is the source of information in the TestDisk world. I don't know what a "Ubuntu USB run test" is. Your statement suggests that your NVME SSD was connected externally. That piece of information belongs into your initial case description case as your interface could be the culprit. I am not using this NVME stuff. If your mainboard has slots where they can be used I would use that different interface, otherwise I would use another third interface. You would need to exclude the interface as a possible source of error.I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.
Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.
I booted from a live Ubuntu USB run test, but no information came out of that.
That is a very bad sign.
Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.
Geometry information is legacy stuff that is not needed on modern operating systems and I pretend this applies to modern Apple computers as well.
Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.
Bring your NVME to a professsional lab if your NVME interface is not the culprit and restore your backup - it is pretty good that you have one at least!
Any help will be appreciated, thank you.
-
- Posts: 5
- Joined: 12 Mar 2024, 07:55
Re: photorec finds headers but no files
hbivort wrote: ↑13 Feb 2024, 01:20 I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.
I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.
Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.
I booted from a live Ubuntu USB run test, but no information came out of that.
Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.
Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.
Any help will be appreciated, thank you.
Hey hi, sorry but have you attempted to recover your files using alternate software or method beside Photorec?