cgsecurity.org

I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.

I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.

Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.

I booted from a live Ubuntu USB run test, but no information came out of that.

Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.

Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.


Any help will be appreciated, thank you.

> Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.

Incomprehensible, please explain.
Thank you!

I am running photorec, pass 0 finishes in 5 minutes and finds a number of headers.
Pass 1 and 2 fail to find any files ( screen says zero files)

For reference this is the output

<dfxml xmloutputversion="1.0">
<metadata xmlns="http://www.forensicswiki.org/wiki/Categ ... ensics_XML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:type>Carve Report</dc:type>
</metadata>
<creator>
<package>PhotoRec</package>
<version>7.1</version>
<build_environment>
<compiler>GCC 11.2</compiler>
<library name="libext2fs" version="1.46.5"/>
<library name="libewf" version="none"/>
<library name="libjpeg" version="libjpeg-turbo-2.1.1"/>
<library name="libntfs" version="libntfs-3g"/>
<library name="zlib" version="1.2.11"/>
</build_environment>
<execution_environment>
<os_sysname>Linux</os_sysname>
<os_release>5.15.0-43-generic</os_release>
<os_version>#46-Ubuntu SMP Tue Jul 12 10:30:17 UTC 2022</os_version>
<host>ubuntu</host>
<arch>x86_64</arch>
<uid>0</uid>
<start_time>2024-02-12T19:54:18+0000</start_time>
</execution_environment>
</creator>
<source>
<image_filename>rescue.img</image_filename>
<sectorsize>512</sectorsize>
<image_size>2000398934016</image_size>
<volume>
<byte_runs>
<byte_run offset="0" img_offset="0" len="2000398934016"/>
</byte_runs>
</volume>
</source>
<configuration> </configuration>
<fileobject>
<filename>f0000002.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1024" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037056.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="18972672" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f0037120.ext</filename>
<filesize>512</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19005440" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f4193792.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="2147221504" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f12581376.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="6441664512" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f20968960.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="10736107520" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f29356544.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="15030550528" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f37744128.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="19324993536" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f104844800.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="53680537600" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f113232384.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="57974980608" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f205495808.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="105213853696" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f339697152.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="173924941824" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f524224000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="268402688000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1019091456.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="521774825472" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f1438470656.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="736496975872" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f2621120000.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1342013440000" len="512"/>
</byte_runs>
</fileobject>
<fileobject>
<filename>f3057274368.ext</filename>
<filesize>33280</filesize>
<byte_runs>
<byte_run offset="0" img_offset="1565324476416" len="512"/>
</byte_runs>
</fileobject>
</dfxml>

You did not define what "header" means with regards to Photorec. Given your information I was able to guess what you were refering to.

hbivort wrote: 13 Feb 2024, 01:20 I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.

In case of problems, running ddrescue is typically the best choice to preserve the status quo.

I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.

Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.

I booted from a live Ubuntu USB run test, but no information came out of that.

The TestDisk log file is the source of information in the TestDisk world. I don't know what a "Ubuntu USB run test" is. Your statement suggests that your NVME SSD was connected externally. That piece of information belongs into your initial case description case as your interface could be the culprit. I am not using this NVME stuff. If your mainboard has slots where they can be used I would use that different interface, otherwise I would use another third interface. You would need to exclude the interface as a possible source of error.

Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.

That is a very bad sign.

Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.

Geometry information is legacy stuff that is not needed on modern operating systems and I pretend this applies to modern Apple computers as well.

Any help will be appreciated, thank you.

Bring your NVME to a professsional lab if your NVME interface is not the culprit and restore your backup - it is pretty good that you have one at least!

hbivort wrote: 13 Feb 2024, 01:20 I have a 2TB Samsung nvme SSD, otiginally it had a single ext4 partition. It was running out of space, and, all of a sudden, It was unable to mount at startup.
I forced it to mount from the terminal and was able to see the files.

I tried changing the superblock as I thought that was the issue.
After that, the partition became an ext2. I promoted it back to ext4.

Still, after that, it would not mount at startup, and as you might suspect now, I could not see the files.

I booted from a live Ubuntu USB run test, but no information came out of that.

Currently, I am running Photorec, and it quickly finds headers, but somehow, it does not find any files.

Luckily, I have an older image from the same partition, so I think I could extract geometry information from there.


Any help will be appreciated, thank you.

Hey hi, sorry but have you attempted to recover your files using alternate software or method beside Photorec?