I find it interesting that this sub upvoted my question, while /r/techsupport downvoted it into oblivion and didn't get any comments. Since inodes are used sequentially (in a not-too-horribly-fragmented filesystem), and since the files were copied in order, I just had to figure out the range of inodes that probably contained some of the images I wanted to check, and recover those. I set the hardware clock to a time about 11 hours after removing the files (so that the program automatically grouped all the earlier deletions into the second bin or later), which gave me about 1400 inodes in the first bin. It bins files into groups based on time since deletion, at 12 hours, 48 hours, and a few more. I think e2undel just has a limit in it on how many inodes it can deal with at any given time. I don't know if debugfs is already installed or not, but if not, e2undel worked without it. Thanks /u/HeidiH0 /u/Djhg2000 /u/unixtreme, got them with e2undel. It's a 500gb drive filled with crap, and I don't have OCD badly enough that I want to wade through everything that is now and was ever on the drive just to check my paranoia. I might try to find the source code just for hahas, since its ability to undelete specific named files is a lot more useful for this situation than Photorec's "search for every single file in the raw data of the drive" method of undeleting. It appears to have last been updated in 2004, so I guess it's a dead project. I also found a very old utility named "e2undel", which finds 10,982 deleted files on the drive (reasonable) but then crashes when it tries to list them. It's version 6.14-WIP if that makes a difference. No files are showing up in red (nor are the just-deleted files merely listed in the wrong color).Īre there other steps that need to be done before going into undelete? Has Testdisk stopped working for undeleting files in ext2? I haven't used it before, so did it ever work for undeleting files in ext2 as it claims? I followed the tutorial on CGSecurity exactly. I unmounted the filesystem and ran Testdisk. A few minutes later I realized I should have looked for something specific in them first.
0 Comments
Leave a Reply. |