cgsecurity.org

I'm running Windows 10 v1809 with WSL and Ubuntu 18.0.4.

I need to restore one single undeleted file, my .bashrc in my home directory, which is in the Windows filesystem, i.e. /mnt/c/Users/sxw455/Ubuntu/ rather than /home/sxw455/.

Windows C is mounted as /mnt/c, and I have a flashdrive mounted as /mnt/d. I noticed that there is also a copy of C mounted as /c, but I don't know why.

testdisk, reports 'No harddisk found', but I can read all of the contents of C or D.

testdisk /mnt/c reports 'Unable to open file or device /mnt/c: Inappropriate ioctl for device'

fdisk -l reports 'fdisk: cannot open /proc/partitions: No such file or directory'

Running any of the commands as sudo or after unmounting the device gives the same results.

Any suggestions?

sxw455@9JB06H2:/home/sxw455$ strace testdisk 7.0-WIP
execve("/usr/bin/testdisk", ["testdisk", "7.0-WIP"], 0x7fffe4c03ba8 /* 14 vars */) = 0
brk(NULL) = 0x7fffd3854000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=39090, ...}) = 0
mmap(NULL, 39090, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f517c04f000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libncursesw.so.5", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340q\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=190400, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f517c040000
mmap(NULL, 2286072, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517bbd0000
mprotect(0x7f517bbfd000, 2097152, PROT_NONE) = 0
mmap(0x7f517bdfd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2d000) = 0x7f517bdfd000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libtinfo.so.5", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\311\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=170784, ...}) = 0
mmap(NULL, 2267936, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517b9a0000
mprotect(0x7f517b9c5000, 2097152, PROT_NONE) = 0
mmap(0x7f517bbc5000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x25000) = 0x7f517bbc5000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libuuid.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\26\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=27112, ...}) = 0
mmap(NULL, 2122112, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517b790000
mprotect(0x7f517b796000, 2093056, PROT_NONE) = 0
mmap(0x7f517b995000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f517b995000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libntfs-3g.so.88", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000g\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=321992, ...}) = 0
mmap(NULL, 2417272, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517b540000
mprotect(0x7f517b58e000, 2093056, PROT_NONE) = 0
mmap(0x7f517b78d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4d000) = 0x7f517b78d000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libext2fs.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\317\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=323888, ...}) = 0
mmap(NULL, 2419816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517b2f0000
mprotect(0x7f517b33d000, 2097152, PROT_NONE) = 0
mmap(0x7f517b53d000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4d000) = 0x7f517b53d000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\34\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2030544, ...}) = 0
mmap(NULL, 4131552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517aef0000
mprotect(0x7f517b0d7000, 2097152, PROT_NONE) = 0
mmap(0x7f517b2d7000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e7000) = 0x7f517b2d7000
mmap(0x7f517b2dd000, 15072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f517b2dd000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\16\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14560, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f517c030000
mmap(NULL, 2109712, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517ace0000
mprotect(0x7f517ace3000, 2093056, PROT_NONE) = 0
mmap(0x7f517aee2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f517aee2000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\23\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14248, ...}) = 0
mmap(NULL, 2109608, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517aad0000
mprotect(0x7f517aad3000, 2093056, PROT_NONE) = 0
mmap(0x7f517acd2000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f517acd2000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000b\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=144976, ...}) = 0
mmap(NULL, 2221184, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f517a8b0000
mprotect(0x7f517a8ca000, 2093056, PROT_NONE) = 0
mmap(0x7f517aac9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x19000) = 0x7f517aac9000
mmap(0x7f517aacb000, 13440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f517aacb000
close(3) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f517c020000
arch_prctl(ARCH_SET_FS, 0x7f517c0212c0) = 0
mprotect(0x7f517b2d7000, 16384, PROT_READ) = 0
mprotect(0x7f517aac9000, 4096, PROT_READ) = 0
mprotect(0x7f517acd2000, 4096, PROT_READ) = 0
mprotect(0x7f517aee2000, 4096, PROT_READ) = 0
mprotect(0x7f517b53d000, 4096, PROT_READ) = 0
mprotect(0x7f517b78d000, 4096, PROT_READ) = 0
mprotect(0x7f517b995000, 4096, PROT_READ) = 0
mprotect(0x7f517bbc5000, 16384, PROT_READ) = 0
mprotect(0x7f517bdfd000, 4096, PROT_READ) = 0
mprotect(0x7f517c45e000, 8192, PROT_READ) = 0
mprotect(0x7f517c027000, 4096, PROT_READ) = 0
munmap(0x7f517c04f000, 39090) = 0
set_tid_address(0x7f517c021590) = 120
set_robust_list(0x7f517c0215a0, 24) = 0
rt_sigaction(SIGRTMIN, {sa_handler=0x7f517a8b5cb0, sa_mask=[], sa_flags=SA_RESTORER|SA_SIGINFO, sa_restorer=0x7f517a8c2890}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {sa_handler=0x7f517a8b5d50, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f517a8c2890}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=8192*1024}) = 0
time(NULL) = 1572561117 (2019-10-31T18:31:57-0400)
rt_sigaction(SIGINT, {sa_handler=0x7f517c2400c0, sa_mask=[HUP INT], sa_flags=SA_RESTORER, sa_restorer=0x7f517af2ef20}, NULL, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=0x7f517c2400c0, sa_mask=[HUP INT], sa_flags=SA_RESTORER, sa_restorer=0x7f517af2ef20}, NULL, 8) = 0
fstat(1, {st_mode=S_IFCHR|0660, st_rdev=makedev(4, 1), ...}) = 0
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
brk(NULL) = 0x7fffd3854000
brk(0x7fffd3875000) = 0x7fffd3875000
write(1, "TestDisk 7.0, Data Recovery Util"..., 118TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
) = 118
openat(AT_FDCWD, "7.0-WIP", O_RDWR|O_EXCL) = -1 ENOENT (No such file or directory)
write(1, "\n", 1
) = 1
write(1, "Unable to open file or device 7."..., 65Unable to open file or device 7.0-WIP: No such file or directory
) = 65
exit_group(1) = ?
+++ exited with 1 +++

As you are under Windows, please run the Windows version of testdisk.
Note, under Linux, you should not run "testdisk 7.0-WIP" as it tried to open the device "7.0-WIP" but "sudo testdisk" (or testdisk as root).

Installed testdisk_win and ran it, selected 'Create a new log file', and /dev/sda (my 256GB C drive). I also have /dev/sdb (a 16GB flash drive). Then I selected 'EFI GPT,' as that was what testdisk detected, and 'Advanced'.

I've now got 5 partitions listed; 'MS Data' and 'Basic data partition' looks to be my C drive, at 238GB, so I selected that. Under 'Type', 'MS Data', I selected 'NTFS', and went to undelete, and it said 'Can't open file system. File system seems damaged'. Now there is nothing wrong with the file system, I'm just trying to recover a single deleted file. For grins, I tried FAT32 and FAT16, but got the same message.

What am I missing?

Thanks,