cgsecurity.org

Hello all,

I'm just in nightmare... I dont write the full history but in short, I tried to recover deleted data on a linux server in a virtual machine and LVMs. I used Testdisk and send the result to an external NAS. After 1 day I realized my NAS was full of data..
When I had a look on the recovery structure, I realized that some files were now directories and inside these 'new' directories was a part of the structure (file and folders) of my server ! And this hundreds of times ..
For the while, I've no explication on this.. so if someone has an idea to help me understand

Second part of the problem : so I decided to start the recovery once more but folder after folder but I had first to emply my nas. I began to delete a few files and checked my server was fine . then I delete afew folders and made a new check.. everything was fine on my server. Finally I started a full delete on my nas. Everything was running fine but suddendly, (this is the second part I dont understand) while deleting on my NAS it was deleting on my server, too !
So I lost working files but the whole structure of /var of my server !! so after a while I could not even access it ..

So I stopped it and made a mistake, tried to restart it (in some forums, some said maybe it was just my LVM which was locked and restarting was going to solve the the problem) .. but while restarting, my linux checked that /var was missing and created a new /var folder..but nothing more.

Now, I restarted my server with a rescue disk, made a copy of my harddrive using the 'dd' command. I'm working yet on that copy and I'm trying to recover the files that were under the /var folder but as it has been recreated , testdisk cannot see the missing structure (inside it I had my working datas, thousands of files)...
So If someone has an idea I can try, it's really really welcomed

Thanks to all

Did you copy files using TestDisk or did you use PhotoRec ?
For deleted files from ext3/ext4 or xfs filesystem, your actual problem, you can use PhotoRec to recover them. They will not have their original filenames or directory structure.

Hello,
Thanks for your answer I first use Testdisk but it did not find my file. I'm going to use now Photorec because the folder structure has been damaged. Do you have an idea on what happened when I first made a testdisk (some files were suddendly seen as folders ) ?

Thanks for your helpe