4

I was in the process of rsyncing data from /mnt/disk1 to /mnt/disk2 and had already modified fstab to remount /mnt/disk1 as /tmp. I didn't pay attention to the progress of the rsync and during the process some parts arrived for the system so I shut it down to install them. I know this is my own stupid fault, in 15 years I've never lost data like this so I'm venturing down a new trail.

Is there any way to recover the data in it's original structure and names? A total of 64K was written to the disk while mounted as /tmp. I'm running PhotoRec right now but the recovered data is not very usable (recup_dir.32/f03183747.txt as an example)

  • 1
    Possible duplicate of Is there any recovery software available for ext4? – Fabby Jul 10 at 18:12
  • I'm not looking for recovery software in general. I can recover the data, what I'm looking for is software that will recover the names and directory structure as well. – Jarad Downing Jul 10 at 19:47
  • Answer adapted as per your comment. 0:-) – Fabby Jul 10 at 19:59
  • I edited the title to add more information. – Jarad Downing Jul 10 at 21:32
  • 1
    TeskDisk helped me a couple of days back. It is a bit hard to figure out. But in the end, it gave the drive as it is. – user227495 Jul 11 at 6:59
0
  1. Do not write to disk1 any more: use it for reading only.
  2. If you need to do writes, make a copy first using ddrescue and write to the copy only.

    apt install gddrescue
    man ddrescue
    
  3. If disk1 contains an ntfs file system, use RecuperaBit first!
    As ntfs contains multiple MFTs, you might recover some or all of the directory structure.

  4. If you arrive at this step, you probably have EXT2/3/4 FS on your disk. Recovering the directory structure is going to be difficult if both superblocks are overwritten: try this first on the copy you made from the original disk.

  5. Use TestDisk before you use PhotoRec

  6. Use autopsy before you use PhotoRec
  7. Use R-Disk before using PhotoRec
  8. Only if all else fails, start using PhotoRec

The best solution here is to restore your backup thought and if you don't have a backup, start making a backup ASAHP

  • It's ext4 - wish it was zfs or it was in a raid :( – Jarad Downing Jul 10 at 21:33
  • RAID is not a replacement for a backup: it just replicates the same mistake over multiple drives. – Fabby Jul 11 at 6:29
  • true, I was thinking along the lines of gluster. Anyway none of the software you mentioned was able to do what I needed. In the end I just recreated the files that I absolutely had to have and will keep the image I created around if I notice something else missing. Since you supplied an answer that, while didn't solve my problem, did provide something like PhotoRec to recover some data (all others failed). – Jarad Downing Jul 11 at 17:41
  • Sorry to hear that, thanks for the acceptance, favour returned: question upvoted! – Fabby Jul 11 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.