File undelete with TestDisk

Using TestDisk to undelete files
Post Reply
Message
Author
User avatar
cgrenier
Site Admin
Posts: 3573
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

File undelete with TestDisk

#1 Post by cgrenier » 26 Mar 2013, 08:11

TestDisk can recover deleted files from the following filesystem
- NTFS
- FAT1216/32, exFAT
- ext2
Use PhotoRec for other filesystems or if TestDisk doesn't find your files.

Sponsored links

DSpider
Posts: 23
Joined: 29 Jul 2013, 10:41

Re: File undelete with TestDisk

#2 Post by DSpider » 01 Aug 2013, 09:41

So it is not possible with ext4 files ?

User avatar
cgrenier
Site Admin
Posts: 3573
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete with TestDisk

#3 Post by cgrenier » 17 Aug 2013, 09:20

When a file is deleted from an ext3 and ext4 filesystem, the location of the first block is zeroed, so TestDisk can list all filenames, deleted or not, but it's not possible to undelete them. PhotoRec can be use to recover files with known filetypes from the free space of the filesystem and recover them but without the original filenames.

gwaag
Posts: 2
Joined: 03 Sep 2014, 10:53

recovered video files are in segments

#4 Post by gwaag » 03 Sep 2014, 12:17

Hello.
I used testdisk photrec. Now a have hundrets of segments in the file on my extern USB drive which I used to store the recoverd files. The recoverd files come from a other USB drive which had the originals as ext4.
What can I do to get the videos as one file??
regard
gwaag

User avatar
cgrenier
Site Admin
Posts: 3573
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete with TestDisk

#5 Post by cgrenier » 08 Sep 2014, 06:38

If the files were stored on an ext4 filesystem, when you run PhotoRec, you need to select "[ext] ext2/3/4", otherwise indirection blocks will not be detected.

Metallion
Posts: 4
Joined: 22 Mar 2016, 21:33
Location: Figueira da Foz, Portugal
Contact:

Re: File undelete with TestDisk

#6 Post by Metallion » 29 Mar 2016, 18:41

I saw somewhere in the internet that TestDisk 6.14 had an option to Undelete.
The actual version doesn't have it, at least, it seems that to me.

I'm trying to undelete some files that i had in my external disk (Mac formatted) with their original names.

I used the PhotoRec for a few days in a row, but lots of wavs, mp3, cpr, came corrupted.
(The wavs and mp3 higher than 10Mb usually are all corrupted)

Am i missing something?

Thanks in advance!

rktrcr
Posts: 1
Joined: 06 Oct 2016, 04:56

Re: File undelete with TestDisk

#7 Post by rktrcr » 06 Oct 2016, 05:10

I was an idiot today. I was backing up audit log files on multiple rhel 6 workstations. I moved/copied/tar multiple files into a dir once all files needed for back up are there I mkisofs of these files. after I make the iso on the remote workstations I scp them to the workstation I am at. once I verified the size of the iso image I scp is the same as the original I rm all the files. I did this on all the machines and got keyboard happy and actually deleted the directory that contained all the iso images. I have powered down the computer to hopefully keep these files intact. Can I recover just the .iso files using test disk or photorec? or will I need to try and recover all the audit files then start over? I am weary of installing livedisk on the hard drive I want to recover these audit log. Which LiveCD works best with RHEL 6? Would a live CD be the best option? or just install on the hard drive and hope for the best?

Aloha
Mike

User avatar
cgrenier
Site Admin
Posts: 3573
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete with TestDisk

#8 Post by cgrenier » 06 Oct 2016, 05:56

You can use PhotoRec to recover the .iso. If needed, disable all other files in FIleOpts.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests