Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #274064

Re: recover files

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sat, Oct 26, 2024 at 09:57:11AM +0700, Max Nikulin wrote:
> On 26/10/2024 02:03, Hans wrote:
> > Am Freitag, 25. Oktober 2024, 20:32:29 CEST schrieb louletian@sina.com:
> > > Hi folksIs there possible to recover deleted files in ext4 filesystem?
> > 
> > Try extundelete.
> [...]
> > Using an image, you can try nice tools like foremost, scalpel or autopsy to
> > recover files.
> > 
> > Also you can use CAINE, KALI or DEFT (these are forensis suites) for data
> > recovery.
> 
> Have you tried these tools in action? I believe that removing files from
> ext4 wipes list of used blocks and explicitly zeroes size in inode records,
> so a chance of recovery is quite low. Some info for recently accessed files
> may be restored from filesystem journal. In the case of contiguous block
> spans signature-based search (e.g. photorec from the testdisk package) may
> find some files, but they will be buried in the heap of false positives
> without any hints related to file names and directory structures.

I actually tried photorec a while ago. It uses heuristics to guess which
free blocks to stitch together and it's not *that* bad. But: you have to
be quick (the more you use your file system the worse your recovery chances),
you need *a lot* of extra storage (there's more than one way to stitch
a junkyard together) and you'll have to wade through quite a bit of stuff.

And oh, it takes quite a bit of time to chew through a file system.

Cheers
-- 
t

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

recover files louletian@sina.com - 2024-10-25 20:40 +0200
  Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-25 21:10 +0200
    Re: recover files Max Nikulin <manikulin@gmail.com> - 2024-10-26 05:00 +0200
      Re: recover files <tomas@tuxteam.de> - 2024-10-26 08:30 +0200
      Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-26 10:00 +0200
        Re: recover files Max Nikulin <manikulin@gmail.com> - 2024-10-26 13:40 +0200
          Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-26 15:30 +0200
            Re: recover files Max Nikulin <manikulin@gmail.com> - 2024-10-26 17:10 +0200
              Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-26 18:40 +0200
                Re: recover files <tomas@tuxteam.de> - 2024-10-26 18:50 +0200

csiph-web