Anything related to computer forensics (new section!)
Post a reply

which software can retrieving deleted file ext4 (urgant)

May 22nd, 2023, 17:30

hey there ,
so heres is my case.

i will be thorough as possible , that way i hope answering most of the question .

i have an NVR of a chines brand that was placed in an elderly (grandpa) house .
something went missing , and upon checking the playback video , someone deleted that part as well as removing the part where that someone deleted those files.
i have unmounted the drive of the nvr to retrieve the deleted file .


its an HGST 0f21905 drive 4TB , it has 8 partitions , each partition is 466GB~ , there is still 1.5tb-+ left untill full .
the drive is formated as EXT4 , and the recording are being saved as an AVI files .
every 30min couple of files are being created , sub and main avi (sub = lower resolution , main = hd resolution) .
aswell as ​.avi​_idx ​and .avi​_pos​

i suspect in total there was 24+ (from one date) files deleted about a month ago.

i have tried to run recoverit , aswell as r-studio .
in r-studio i have scanned the whole 4tb and on the partition 3 that the file got deleted , however no avi files was found neither idx/pos file .

there was some random extention file that are not really related .

hoped i explained properly , and hopefully you could help me to guide me what to do next.


https://img001.prntscr.com/file/img001/ ... HZzloA.png
https://img001.prntscr.com/file/img001/ ... Sec67w.png

https://img001.prntscr.com/file/img001/ ... BCb1bA.png

https://img001.prntscr.com/file/img001/ ... eH41NA.png


thank you very much .


if a better software as to be bought or device i dont mind investing abit .

side note
since the deleted files was not found , i dont know if the person deleted the files or just cut them from its place.

Re: which software can retrieving deleted file ext4 (urgant)

May 22nd, 2023, 17:56

update , i tried to use UFS explorer pro , surprisingly enough , it managed to receover some avi files .
however those videos are mostly the same , from a specific date (not the date i am looking for) ,
the dates are allways the 19-20 of each month (i checked other parition) , and it seems that the 19-20 of each month is the date where the files are being writting into the new parition .

Re: which software can retrieving deleted file ext4 (urgant)

May 24th, 2023, 6:32

Do I understand correctly the device was in use for a month after the files were deleted?
Post a reply