cgsecurity.org

New TEstDisk user here so apologies in advance if I'm making some noob mistake.

I deleted a file a few months ago (I know part of the name of the file) and I tried to use TestDisk following one of the online guides, however I was only able to get so far.

After creating a log file it shows me:

Select a media (use Arrow keys, then press Enter):
>Disk /dev/md0 - 34 GB / 31 GiB
Disk /dev/md1 - 536 MB / 511 MiB
Disk /dev/md2 - 477 GB / 444 GiB
Disk /dev/nvme0n1 - 512 GB / 476 GiB - NVMe D512
Disk /dev/nvme1n1 - 512 GB / 476 GiB - NVMe D512

When I select the first in the array (nvme0n1) and select 'Intel' then 'Advanced' it shows me:

Disk /dev/nvme0n1 - 512 GB / 476 GiB - CHS 488386 64 32

Partition Start End Size in sectors
1 P Linux RAID 1 0 1 32768 63 32 67108864 [rescue:0]
2 P Linux RAID 32769 0 1 33280 63 32 1048576 [rescue:1]
3 P Linux RAID 33281 0 1 488385 21 16 932053680 [rescue:2]

But it only shows me:

[ Type ] [Image Creation] >[ Quit ]

At the bottom - there is no LIST option

Am I doing something wrong?

Software raid is used. Select /dev/md2 instead of /dev/nvme0n1.
I don't know if LVM is used or not on top of software raid...

Thanks - that worked

Unfortunately I wasn't able to find the file

Is there a way to search for deleted files with a wildcard? That would be very cool

Photorec has an option to search the free space only.

recuperation wrote: 17 Oct 2019, 08:03 Photorec has an option to search the free space only.

Do you have a link to any guides that show you how to do that?

When I looked the only thing I found was being able to restore certain file types.