All times are UTC - 5 hours [ DST ]


Forum rules


Please do not post questions about data recovery cases here (use this forum instead). This forum is for topics on finding new ways to recover data. Accessing firmware, writing programs, reading bits off the platter, recovering data from dust...



Post new topic Reply to topic  [ 1 post ] 
Author Message
 Post subject: Undelete encrypted files under /home/$USER/.Private
PostPosted: April 1st, 2015, 21:31 
Offline

Joined: April 1st, 2015, 17:31
Posts: 3
Location: auckland, new zealand
1) Recently I incidentally deleted a lot of files (the encrypted files under /home/$USER/.Private folder, about 140GB in total. some of the VM files size is about 20GB. the /home/ folder is on /dev/sda5 partition with ext4 Linux LVM file system. recently i run "rm -rf .Private" under /home/$USER folder to incidentally deleted almost all the files under /home/$USER folder) from the Ubuntu 64 bits Server OS system server (i updated it from Ubuntu 12.04 to Ubuntu 14.04 in a couple of months ago), and I'm in the process to recover them with extundelete, photorec, ext3grep, testdisk etc. recovering tools (with Ubuntu 14.04.2 LiveCD), but none of them can successfully recover all the deleted files as expected.

It is much appreciated if you can help to have a look at my case and let me know whether your services/products can help to undelete all these data as expected.

2) The progress of my data recovery is as below:

With photorec i recovered about 30GB files, not all the 140GB, to the external HD.

When run "extundelete --restore-all /dev/mapper/ubuntu--vg-root" command, I can only recover about 700M files and get a lot of console output of "Unable to restore inode xxxxxx ...... : Space has been reallocated" and the final console output is "Failed to restore inode xxxxxx to file RECOVERED_FILES/xxxxxx: Some blocks were allocated".

The testdisk and ext3grep tools don't look as good as photorec and extundelete tools in my case.

When the /home/$USER/.Private folder (in /dev/sdb5 partition with ext4 Linux LVM file system) was "rm -rf ./Private"), I don't know I need to turn off the PC immediately, while leave it running for about two days, run "apt-get update" for a couple of times, but didn't create any folders or add any files to this partition.

I made a image copy of the whole drive /dev/sdb with dd command before I start to recover the deleted data.

The data recovering tools I have used so far are open source ones. It is much appreciated if you can recommend me some better tools so can recover all the deleted data.

Thank you very much for your help and have a great Easter !


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 20 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group