File undelete with TestDisk

[cgrenier]

TestDisk can recover deleted files from the following filesystem
- NTFS
- FAT1216/32, exFAT
- ext2
Use PhotoRec for other filesystems or if TestDisk doesn't find your files.

[DSpider]

So it is not possible with ext4 files ?

[cgrenier]

When a file is deleted from an ext3 and ext4 filesystem, the location of the first block is zeroed, so TestDisk can list all filenames, deleted or not, but it's not possible to undelete them. PhotoRec can be use to recover files with known filetypes from the free space of the filesystem and recover them but without the original filenames.

[gwaag]

Hello.
I used testdisk photrec. Now a have hundrets of segments in the file on my extern USB drive which I used to store the recoverd files. The recoverd files come from a other USB drive which had the originals as ext4.
What can I do to get the videos as one file??
regard
gwaag

[cgrenier]

If the files were stored on an ext4 filesystem, when you run PhotoRec, you need to select "[ext] ext2/3/4", otherwise indirection blocks will not be detected.

[Metallion]

I saw somewhere in the internet that TestDisk 6.14 had an option to Undelete.
The actual version doesn't have it, at least, it seems that to me.

I'm trying to undelete some files that i had in my external disk (Mac formatted) with their original names.

I used the PhotoRec for a few days in a row, but lots of wavs, mp3, cpr, came corrupted.
(The wavs and mp3 higher than 10Mb usually are all corrupted)

Am i missing something?

Thanks in advance!

[rktrcr]

I was an idiot today. I was backing up audit log files on multiple rhel 6 workstations. I moved/copied/tar multiple files into a dir once all files needed for back up are there I mkisofs of these files. after I make the iso on the remote workstations I scp them to the workstation I am at. once I verified the size of the iso image I scp is the same as the original I rm all the files. I did this on all the machines and got keyboard happy and actually deleted the directory that contained all the iso images. I have powered down the computer to hopefully keep these files intact. Can I recover just the .iso files using test disk or photorec? or will I need to try and recover all the audit files then start over? I am weary of installing livedisk on the hard drive I want to recover these audit log. Which LiveCD works best with RHEL 6? Would a live CD be the best option? or just install on the hard drive and hope for the best?

Aloha
Mike

[cgrenier]

You can use PhotoRec to recover the .iso. If needed, disable all other files in FIleOpts.

[arisingtech]

I tried undelete on exfat and I was searching for .hds file but there is only one version.
Is it correct?
Can I see other version?

Regards
Roberto