On 26/10/2024 14:53, Hans wrote:
Yes, whilst extundelete is not so easy to use,
Thank you for the detailed answer.
I have tried ext4magic. My impression is that it might have an issue
with reading journal and that it is unnecessary strict walking through
inodes (zeroing invalidates checksums if I remember it correctly). It
may restore some files, however I can not figure out what approach
extundelete or other tools may use to noticeably improve success rate
since important data is overwritten.
I was very successfull with photorec and autopsy.
Does autopsy/sleuthkit use some heuristic that allows to restore
significantly more data than extundelete and photorec in the case of
unintentional removing of directories?
Last time I had to revover 2 TB music files for a friend, and photorec gave me
all files back.
Of course, a few MB size files with reach metadata (audio, image, zip)
is an optimal case for photorec and foremost. For 1 hour long .mp3 files
fragmentation causes recovery of only some parts of files (at least in
the case of FAT32).
Also foremost is another tool of my favourites, as it is easy to use.
I am curious what are cases when it may perform noticeably better than
photorec.
