After accidentally deleting mp4 files I created an image of the mounted 5-TB-partition for recovery. It has been quite some time between deletion and imaging, as I did not notice the issue very quickly. Now I try several ways to recover. As undelete files on ext4 is pretty dated I created a new post.
- extundelte aborts at stage
Loading journal descriptors
malloc(): invalid next size (unsorted)
The (virtual) system I use for recovery has 10 GB of RAM and before the crash only about 500MB are used, so I do not think the cause is "not enough RAM".
This bug(?) may has been reported before on fedora/red hat: https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=1692742 but it seems like sadly it was not fixed there either.
- ext4magic: The filelisting created by
-a NNNNNNNNNNNN -f / -l
does not include the relevant files, so the journal seems to have been cleaned in between.
- PhotoRec/Carving did recover some files but playback is possible only for parts of the media, so it seems that the files have been fragmented in the file system and PhotoRec cannot handle that.
Does anybody have any idea for further options? I have some broader ideas, but did not yet find a method/tool to try these:
- Advanced Carving methods that can cope with fragmentation (I only found tools for small flash media, not for large disks)
- Recovery of the previous journal? (e.g. by carving, but most likely overwritten by the new journal I think)
- Recovery based on non-reused inodes (how many information remain at the inodes after deletion until they are reused?)
Thanks for reading
more resources I found already: https://unix.stackexchange.com/questions/122305/undelete-a-just-deleted-file-on-ext4-with-extundelete https://blog.dbi-services.com/oooooops-or-how-to-undelete-a-file-on-an-ext4-filesystem/