Re: [Extundelete-users] Only partial recovery

[<ext...@li...>]

Hi N,

I have added some comments below:
On 3/19/17 5:22 PM, ext...@li... wrote:
> Hello everyone.
> 
> As, I guess, most people here, I accidentally deleted some files, my whole data dir in my case : approx. 2TB of data with:
> - 3 or 4 dirs, probably 800GB worth of small files (epubs and pictures)
> - 2 dirs full, probably 500GB worth of big files (isos and archives)
> - 1 dir with mixed content.
> 
> To worsen everything, I afterwards created some files (probably a hundred), amounting to less than 100MB of write.
> 
> Extundelete was able to recover 1 of my folder with big files, and partially recover one of the folder full of small files, totalling approx. 150GB of recovered files.
> 
> Before giving up, I want to understand why I didn't recovered more files (and if possible, recover more !). So several questions :
> 
> - I get that writing back onto the drive was bad, but how can writing ~0.005% of the drive capacity impair the recovery by ~90% ?

exundelete needs information from the journal to recover files.  It may
be that the writing caused writes to the journal that overwrote a
significant part of the journal.

> - Could it be that, my original rm -rf created journal records actually bigger than the journal ?

It is possible that the journal wrapped around during the deletion
operation.  Single transactions would still be smaller than the journal,
but the deletion operation may have been split into several journal
transactions.

> - Lastly, any ideas ?

You could try manual recovery, similar to the procedure on this page:
https://carlowood.github.io/howto/undelete_ext3.html .


> 
> I've already had a look at carving tools (mainly photorec), but the amount of data is too big to be sortable afterwards, given that such tools won't restore folder hierarchy. 
> testdisk seems to be able to see the deleted root folders though, but can't go into nested sub-folders. I don't know how it does that.

It is pretty easy to list names of lots of deleted files (they are right
next to the names of the files still there); the hard part is finding
the data.

> 
> PS : the irreplaceable files were backed-up, I'm trying to recover the "should I know who they were, I should be able to download them again" files : documentation and books, mainly.
> 

Maybe seeing the file names is enough for that purpose.

Nic