Home » Forums » Data Recovery forum

How to recover a file lost by saving a shorter version over the original?

Submitted by mikea on Mon, 10/05/2009 - 19:46.

A much smaller version of a file I'm trying to recover was inadvertently saved over the complete version.
I've found several of the missing blocks by:

Extract the unallocated (deleted) blocks from the partition:

sudo dls /dev/sda1 >unallocated

Extract all of the ASCII strings:

strings -t d unallocated >unallocatedStrings

Search for a bit of text known to be in the missing part of the file:

grep -C1000 -i charlie unallocatedStrings >us-charlie
grep -i charlie us-charlie
122068365 By Charlie Petersen

By having grep's output include a large context,
I can open it in an editor to see
the line before byte offset 122040320 is not part of my file,
so my missing block begins there.
.
.
.
122036330 ShowMeridiem=false
122036349 TrueBinary=false
122036366 FlashSeparators=false
122040320 By William Nordhaus
.
.
.
122068365 By Charlie Petersen
.
.
.

Use fsstat to get the partition's block size:

sudo fsstat /dev/sda1 |grep Size
Block Size: 4096

Divide the block offset of the beginning of the block
by the block size to get the block number:

122040320 / 4096 = 29795

Although I've found several missing blocks this way,
I doubt I can remember something specific in each missing block.
Is there a more deterministic way of finding all the other blocks
by associating the ones I've found with inodes or groups or something?
Or can this partition's Ext3 journal be used to see
what happened to this text file recently?
I'm new at this and any help is much appreciated.
The Ubuntu Rescue Remix has already been a big help.

Thanks,
Mike

‹ retrieve ntfs/windoz files after installing ubuntu/droopal appliance Req help recovering a text file that now appears to have zero bytes ›
»

Hi Mike, Photorec is great

Submitted by andrew on Mon, 10/05/2009 - 22:42.

Hi Mike,

Photorec is great at using the filesystem to recover fragmented files. Try carving the filesystem looking only for unallocated blocks. Photorec prompts you as to whether you want to look at unallocated blocks only, or the entire partition. Maybe this will work for you.

»

Thanks for the tip Andrew.

Submitted by mikea on Wed, 10/07/2009 - 11:59.

Thanks for the tip Andrew. I set Photorec options "Paranoid" to No and "Keep corrupted files" to Yes, set it to look only in unallocated blocks, as suggested, and only to look for text files and ran it on the image I'd made with Ubuntu Rescue Remix running as a live CD right after discovering the corrupted file. Photorec created over 1,000 files which I searched for some text I know was in the missing portion:

grep -r "McCurdy (c) 1998" recoveredTextFiles/

That found two matching files: a little redundant one, and a big one that, as far as I can tell, has everything from the lost file that is recoverable! As well as a bit of binary junk at the end, which prevented gedit from opening it. But Mousepad opened it right up from where I could copy and paste the contents back where they belong.

Thanks again,
Mike

»

That's great, glad to hear

Submitted by andrew on Wed, 10/07/2009 - 15:05.

That's great, glad to hear you got your file back.

»