Would love some feedback and suggestions to recover single large file of EXT4

eagarcia

New member
Hello everyone,

I was trying out Linux to see if I could use it full time off of a 300GB 2.5 hard drive and then I decided to go full time by "moving over" to a fresh copy on an SSD.

I used Fedora Workstation and loved it so much that I didn't mind waiting on the hard drive to use it, but I decided to move it to an SSD. While using the hard drive I did gather files from homework, downloads, plans, etc and put them into an image container (simply a very large file) and copied that to the USB.

After I checked both copies that the sizes were correct, which was 2.2GB from both the USB and and the hard drive, I deleted the one on the hard drive, and then shut down the computer. Then I started up the other computer and installed Fedora, and then put in the USB to copy all my files. Unfortunately when i was copying the container, the file copied much quicker, so I checked the size of the file on the USB and now it's only 1.3GB!

I wanted to know if anyone out there would know what tools or methods I can use to recover most if not all of the rest of the file (just one file, a large one). This container is not "extremely" important, it's just archived work from the past month. And yes I know I should have made backups, but the Linux was treated as a sandbox and I didn't really "care" as I knew it was temporary, unfortunately I should have saved my files over network or somewhere else instead of directly on the hard drive.

Right now I have the original hard drive and the USB in it's original condition since I noticed the broken file. I tried using extundelete on the hard drive while in read only mode, and although it did recover a huge amount of install and download files, the 2.1GB container was not in it.

I tried mounting the 1.3GB version file and it did mount, but then Linux said something about the virtual disk not being right.

Is it possible to "scan" the hard drive, and see if it matches the first 1.3GB to a section of the hard drive and then ask for it to pull the rest of the file. If it is no longer possible to recover than that's fine too, I plan on wiping the 300GB drive to use as a scratch drive, but it would be like a Christmas present if you guys had any suggestions on recovering the file. (I thought about "recovering" from the USB drive but I wouldn't know how to since it's not a deleted file, just partially "deleted")

Thanks to any and all who help!
 

Jared

Administrator
Staff member
There are several possible options. I'd start by scanning the HDD which originally contained the 2.2Gb file using R-Studio to see if it finds the file referenced in the file system. If it doesn't find it, then I'd probably analyze the EXT file tables to see if there is a 2.2Gb gap in there anywhere (assuming it's not fragmented) and possibly carve the file out manually. But, that'd take a level of expertise and probably software that's quite expensive to handle. As to the 1.3Gb partial copy (I'm assuming it didn't finish copying) it'd help to know what type of container it was. If it was using a sort of raw format then you might be able to just mount and scan it in R-Studio or UFSExplorer. But, if it was using some sort of encryption that's a whole other story.
 
Top