On 14/03/2016 7:38 AM, Kynn Jones wrote: > @Russ, @Pascal: thanks for your comments and suggestions. They are > very helpful. A couple of things. ext2 is virtually the same as ext3 and ext4, but the latter two have journal logs. Earlier today I was working on a script and I accidentally deleteed it, brought it back with this tool [1]. I wonder if you could re-align your original partition and then try to do recovery of that? There won't be any journal to help though, so the tool I used isn't going to help; but there might be other options to reconstruct the file system from super blocks that haven't been trashed. Cheers AndrewM [1] http://extundelete.sourceforge.net/ # aptitude show extundelete Monday 14 March 22:32:14 AEDT 2016 -- show extundelete Package: extundelete State: installed Automatically installed: no Version: 0.2.0-2.1 Priority: optional Section: utils Maintainer: Debian Forensics <forensics-devel@lists.alioth.debian.org> Architecture: amd64 Uncompressed Size: 157 k Depends: e2fslibs (>= 1.42), libc6 (>= 2.2.5), libcomerr2 (>= 1.01), libgcc1 (>= 1:4.1.1), libstdc++6 (>= 4.6) Description: utility to recover deleted files from ext3/ext4 partition extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted. There is no guarantee that any particular file will be able to be undeleted. Homepage: http://extundelete.sourceforge.net/ # umount /home/andrewm/other # extundelete --restore-file install-wrk/veracrypt/1.17/get-files.sh /dev/mapper/n4800eco--a----vg1-home--andrewm--other # mount /home/andrewm/other # find /root/RECOVERED_FILES/ /root/RECOVERED_FILES/ /root/RECOVERED_FILES/install-wrk /root/RECOVERED_FILES/install-wrk/veracrypt /root/RECOVERED_FILES/install-wrk/veracrypt/1.17 /root/RECOVERED_FILES/install-wrk/veracrypt/1.17/get-files.sh # cp -p RECOVERED_FILES/install-wrk/veracrypt/1.17/get-files.sh /home/andrewm/other/install-wrk/veracrypt/1.17/
Attachment:
signature.asc
Description: OpenPGP digital signature