Any suggestions regarding photorec and linux lvm partition

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
Frogdaddy
Posts: 7
Joined: 08 May 2014, 03:31

Any suggestions regarding photorec and linux lvm partition

#1 Post by Frogdaddy »

cgrenier,

Stupidly, i deleted the main user on the seagate nas, which obviously deleted the data on the data partition which happens to be linux lvm. Are there additional switches and or advanced settings to use with photorec that will increase salvaging of files on that partition? I have not written anything to it and only reading the data off it using photorec with brute force and all file types with some customization (which apparently i don't need because they're included).

What I'm running into is partial jpg's and/or smaller resolution jpg's. Partial mp3's as well.

A can understand getting smaller resolution jpg's as they could be thumbnails, but even the restored 640x480 are smaller than they were originally. In addition, they have 'artifacts' and can't be enlarged without losing quality. Is this a symptom of fragmentation from what I've read?

I also had issues with it restoring dll's and my norton 360 detecting a cloud virus because of dll's being restored at such a fast rate to folders. I'll limit my next recovery to jpg's only and see if I can't get past this.


Is there something else I can do to increase or enhance the chances of getting a better restore to take place or are there limits to what I should accept as it relates to deleted data? I'm not looking for miracles of course just trying to see if this is the program that has the most success and something is better than nothing. Is there something professional data recovery will do that I'm limited by this program? Just trying to salvage what I can and know when I should accept my circumstances and move on.

Thanks again.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Any suggestions regarding photorec and linux lvm partiti

#2 Post by cgrenier »

To get the best results, you need to run PhotoRec on Linux so you can access the logical volume itself instead of the physical device.
To do so, a possibility is to
- record the original disks order in the NAS
- put the disks in your PC
- boot your PC from a Linux LiveCD
- activate if necessary the logical volume (as root, run lvchange -a)
- run PhotoRec and select the md0 (or md1, md2...) device
- store the recovered files on another disk

Frogdaddy
Posts: 7
Joined: 08 May 2014, 03:31

Re: Any suggestions regarding photorec and linux lvm partiti

#3 Post by Frogdaddy »

cgrenier, perhaps I don't even need to be doing this utility at this point just yet. I deleted a user account on this nas via it's front end ui which apparently deleted his directory or lv? I'm going to look into some of the logs and see what commands are used to cleanup users and their folders. It's possible the data is still archived or intact in the /etc/archive directory upon removal. Maybe it used lvremove or something to clean it up once the user is deleted from the interface. Since the data resides on Linxux LVM [Data] when listing.
It could be the logical volume needs to be restored?

I may be jumping the gun with the photorec just yet. There may be some linux related commands and restoring I can do yet. I still haven't written anything on the disk and it may be why I'm getting mixed results from photorec from within windows after installing the drive as a secondary in my windows machine. Like you say, we're looking at the physical device and see files there and are having a heck of a time pulling them off. I pray I haven't damaged anything with all the recovery tools I've tried such as yours and seagates. I think they're ro.

Let you know and thanks for the great suggestions.

Frogdaddy
Posts: 7
Joined: 08 May 2014, 03:31

Re: Any suggestions regarding photorec and linux lvm partiti

#4 Post by Frogdaddy »

I appear the have this down now and working a little better after following your suggestions. At least it's distinguishing between thumbnails and actual jpg's. Quite a few images still have artifact but I'll see if I can deal with that by using some type of image editing software to clean them up. At least they're there and retreivable still. pdf's are in tact. I'll try another pass for docx files and other related ms office files.

Two questions remain for me at this juncture.


Why are some files being duplicated, for example I'm finding three copies of same file but in diff recup dirs? Does this mean it's going to stay in a loop?

It appears to be detecting movies files and separating them into multiple jpg's, like a frame by frame. Can this be avoided?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Any suggestions regarding photorec and linux lvm partiti

#5 Post by cgrenier »

You may have multiple copy of some of your files if you have defragmented your disk in the past.
Concerning the video recovered as multiple jpg, it's probably a mjpeg file. In File Opt, disable everything and only enable mov (mov/mp4/...) file format. Send a link to a short unmodified video taken with your camera if it doesn't work.

Frogdaddy
Posts: 7
Joined: 08 May 2014, 03:31

Re: Any suggestions regarding photorec and linux lvm partiti

#6 Post by Frogdaddy »

cgrenier, I've had better success with live cd and mounting the vg. 220k jpg files. Cleaned up the duplicates and deleted most thumbnails. Any ideas on getting better success with mp3 files or itunes music files? They're incomplete or file size appears large enough but when played they're short and mostly silence. I have yet to try the mov/mp4 and am also still working on docs.
Thanks.

Locked