Re: recover files

From	Max Nikulin <manikulin@gmail.com>
Newsgroups	linux.debian.user
Subject	Re: recover files
Date	2024-10-26 05:00 +0200
Message-ID	<JBFbX-4fQa-1@gated-at.bofh.it> (permalink)
References	<JBxo5-4b7j-9@gated-at.bofh.it> <JBxR7-4bwF-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 26/10/2024 02:03, Hans wrote:
> Am Freitag, 25. Oktober 2024, 20:32:29 CEST schrieb louletian@sina.com:
>> Hi folksIs there possible to recover deleted files in ext4 filesystem?
> 
> Try extundelete.
[...]
> Using an image, you can try nice tools like foremost, scalpel or autopsy to
> recover files.
> 
> Also you can use CAINE, KALI or DEFT (these are forensis suites) for data
> recovery.

Have you tried these tools in action? I believe that removing files from 
ext4 wipes list of used blocks and explicitly zeroes size in inode 
records, so a chance of recovery is quite low. Some info for recently 
accessed files may be restored from filesystem journal. In the case of 
contiguous block spans signature-based search (e.g. photorec from the 
testdisk package) may find some files, but they will be buried in the 
heap of false positives without any hints related to file names and 
directory structures.

I am quite skeptical concerning fraction of successfully recovered files.

Thread

recover files louletian@sina.com - 2024-10-25 20:40 +0200
  Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-25 21:10 +0200
    Re: recover files Max Nikulin <manikulin@gmail.com> - 2024-10-26 05:00 +0200
      Re: recover files <tomas@tuxteam.de> - 2024-10-26 08:30 +0200
      Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-26 10:00 +0200
        Re: recover files Max Nikulin <manikulin@gmail.com> - 2024-10-26 13:40 +0200
          Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-26 15:30 +0200
            Re: recover files Max Nikulin <manikulin@gmail.com> - 2024-10-26 17:10 +0200
              Re: recover files Hans <hans.ullrich@loop.de> - 2024-10-26 18:40 +0200
                Re: recover files <tomas@tuxteam.de> - 2024-10-26 18:50 +0200

csiph-web