Help! I somehow deleted Windows files that I need

Technical issues/questions of an intermediate or advanced nature.
User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#31 by Rava » 22 Sep 2023, 06:20

Ed_P wrote:
22 Sep 2023, 06:06
Where's the executables? :hmmm:
Right under your nose:

Code: Select all

-rwxr-xr-x 1 users 4.0M Aug 23 12:26 fidentify_static
-rwxr-xr-x 1 users  11M Aug 23 12:26 photorec_static
-rwxr-xr-x 1 users 8.3M Aug 23 12:26 testdisk_static
There the are.

As easy workaround, put the *_static somewhere in a local ext[234] folder, let's say you have /mnt/sda3/ as ext3; then put it here:
/mnt/sda3/bin/testdisk_static (folder "/bin" as in "binaries")
Now create a symlink to your Porteus /usr/local/bin like so, as root:

Code: Select all

# cd /usr/local/bin
# ln -s /mnt/sda3/bin/testdisk_static testdisk
Now you can execute "testdisk" since its in your $PATH and the permissions are not messed up since the binary is not on a VFAT or NTFS partition (thus keeping its -rwxr-xr-x) and can be executed by guest and by root (do it as root)


Or create an updated module using my extracted 7.2-WIP as template and replace all old files - especially the binaries - with the recent ones. As I described above.

And one last tip for the future:
You see what files are binaries by their permissions.

Since a tar is a Unix filesystems, binaries will have rwxr-xr-x while text files, html files or man pages will simply have rw-r--r--

Added in 9 minutes 48 seconds:
And by now you should know that Linux not determines which files are executables by their extensions (like DOS or winDOZE does, e.g. .com .exe and such) but if the read and executable bit is set. (A file could be executable but have no read permission thus still could not be executed)
Most easy example:

Code: Select all

guest@rava:/tmp$ echo "echo Hello World" >hello.sh

guest@rava:/tmp$ ls -o hello.sh
-rw-r--r-- 1 guest 17 2023-09-22 08:25 hello.sh
guest@rava:/tmp$ ./hello.sh
bash: ./hello.sh: Permission denied

guest@rava:/tmp$ chmod a+x hello.sh
guest@rava:/tmp$ ls -o hello.sh 
-rwxr-xr-x 1 guest 17 2023-09-22 08:25 hello.sh
guest@rava:/tmp$ ./hello.sh
Hello World

guest@rava:/tmp$ chmod a-r hello.sh
guest@rava:/tmp$ ls -o hello.sh 
--wx--x--x 1 guest 17 2023-09-22 08:25 hello.sh
guest@rava:/tmp$ ./hello.sh
bash: ./hello.sh: Permission denied
Cheers!
Yours Rava

User avatar
Ed_P
Contributor
Contributor
Posts: 8374
Joined: 06 Feb 2013, 22:12
Distribution: Cinnamon 5.01 ISO
Location: Western NY, USA

Help! I somehow deleted Windows files that I need

Post#32 by Ed_P » 22 Sep 2023, 16:25

You're incredible. :friends:

I usually create scripts to execute strange named files. testdisk.sh to run /somefolder/testdisk_static or to activate the module and rename the _static file.


Added in 5 hours 19 minutes 1 second:
testdiskupdate.sh

Code: Select all

#!/bin/bash

# https://forum.porteus.org/viewtopic.php?p=95835#p95835 - Rava

if [ `whoami` != "root" ]; then
   echo -e "Enter root's password\033[1;31m"
   su -c "sh $0 $1 $2"; exit
fi
echo -e "\033[0m"; echo -en "\033]0;Update testdisk\a" 

#set -x;

if [ -d /tmp/modnew/ ]; then
   rm -rf /tmp/modnew
fi
mkdir -p /tmp/modnew

if [ ! -f testdisk*.tar.bz2 ]; then
   wget https://www.cgsecurity.org/testdisk-7.2-WIP.linux26-x86_64.tar.bz2
fi

echo; echo tar xjf testdisk*.tar.bz2 -C /tmp/modnew
tar xjf testdisk*.tar.bz2 -C /tmp/modnew
ls -Rlght /tmp/modnew
read

if [ -d /tmp/modold/ ]; then
   rm -rf /tmp/modold
fi
mkdir -p /tmp/modold; mkdir -p /tmp/modold/l

echo; echo xzm2dir /mnt/sda1/Optional/testdisk-7.2-WIP-x86_64-rava.xzm /tmp/modold 
xzm2dir /mnt/sda1/Optional/testdisk-7.2-WIP-x86_64-rava.xzm /tmp/modold         <<<<  adjust to your folder name
ls -Rlght /tmp/modold
read

echo; echo cp -a -r /tmp/modnew/testdisk-7.2-WIP/new2023* /tmp/modold/
cp -a -u /tmp/modnew/testdisk-7.2-WIP/VERSION     /tmp/modold/
cp -a -u /tmp/modnew/testdisk-7.2-WIP/INFO        /tmp/modold/
cp -a -u /tmp/modnew/testdisk-7.2-WIP/*.8         /tmp/modold/usr/man/man8/
cp -a -u /tmp/modnew/testdisk-7.2-WIP/*_static    /tmp/modold/usr/bin/
cp -a -u /tmp/modnew/testdisk-7.2-WIP/l/*         /tmp/modold/l/
ls -Rlght /tmp/modold
read

echo; echo Run /tmp/modold/usr/bin/test*
read

dir2xzm /tmp/modold /tmp/testdisk-7.2-WIP-x86_64-Aug2023.xzm
echo
echo 
ls -sh   /tmp/*.xzm
echo
echo Copy the /tmp/testdisk-7.2-WIP-x86_64-Aug2023.xzm module to the Optional folder.
read
Seems to have worked.

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, August 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org


TestDisk is free data recovery software designed to help recover lost
partitions and/or make non-booting disks bootable again when these symptoms
are caused by faulty software, certain types of viruses or human error.
It can also be used to repair some filesystem errors.
Last edited by Ed_P on 29 Sep 2023, 20:53, edited 1 time in total.
Reason: Added the code to make the new Aug2023 .xzm module.
Ed

User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#33 by Rava » 22 Sep 2023, 22:24

Ed_P wrote:
22 Sep 2023, 21:44
Seems to have worked.
Good for you.
Could be you encounter the same issue I did with the terminal that needed

Code: Select all

reset
- or not.

But do not write anything ever to the broken partition unless a full recovery cycle is done to recover and save as many files from it as you can get.

Read the output and all helpful info you can get on testdisk thoroughly to not cause any more data loss.
You need a partition - best on a separate drive - that has at least the amount of free space that your crashed partition is large. E.g. when your corrupt partition was 800 GB then you need at least 800 GB of free space on a different drive.

Cave! The recovery of files takes some time. Do not interrupt that process or you can start all over from the beginning.

The Nov 2020 version I used was unable to recover the original file names, I'm quite sure the most current version cannot do that as well. My lsfind database of the corrupted partition helped me with that when looking for files as listed via "ls -o" - I could look for recovered files with the exact same file size. But most folks would not have such a database of all their partitions be the external or internal. (I coded that lsfind suit for myself to find any files when I do not recall on which external thumbdrive or external harddisk a certain file was put on)

Modules are files that come in increments of 4k, so some modules have the exact same file sizes.

But I am sure you do not have a database of the corrupted drive listing all files like I did have, and Ido this kind of creating the listings regularly on all my devices via my lsfind suite so all you get will be f0000001.jpg and f0000002.exe and such up to the number of recovered files and you have to figure out by yourself what e.g. file f0000001.jpg originally was.
Cheers!
Yours Rava

User avatar
Ed_P
Contributor
Contributor
Posts: 8374
Joined: 06 Feb 2013, 22:12
Distribution: Cinnamon 5.01 ISO
Location: Western NY, USA

Help! I somehow deleted Windows files that I need

Post#34 by Ed_P » 07 Oct 2023, 03:58

So now it begins. I need to get testdisk to work with my /dev/nvme0n1p7 drive. It's the one with the deleted files I need to recover.
Image
Ed

User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#35 by Rava » 07 Oct 2023, 04:36

Ed_P wrote:
07 Oct 2023, 03:58
So now it begins. I need to get testdisk to work with my /dev/nvme0n1p7 drive. It's the one with the deleted files I need to recover.
https://i.postimg.cc/ykzhxxMh/Screensho ... -47-22.png
I presume it's this one according to your screenshot?

Code: Select all

Disk /dev/sdb - 500 GB / 465 GiB - To external USB 3.0
???

Read testdisk's every output thoroughly. e.g. here it's the stuff at the bottom starting with Note:
Recovery should be slow, better wait a few minutes pondering if what you will tell testdisk to do is the correct choice (both as choice itself when you have several, but also concerning if you choose the correct source and target) or the incorrect one. =@
Cheers!
Yours Rava

User avatar
Ed_P
Contributor
Contributor
Posts: 8374
Joined: 06 Feb 2013, 22:12
Distribution: Cinnamon 5.01 ISO
Location: Western NY, USA

Help! I somehow deleted Windows files that I need

Post#36 by Ed_P » 07 Oct 2023, 04:41

It doesn't list any of the deleted files. Only what's left. :(
Rava wrote:
07 Oct 2023, 04:36
I presume it's this one according to your screenshot?
sdb is the old harddrive I am using to copy the recovered files to. sda is the Porteus USB drive I'm booted on. The /dev/nvme0n1 is the harddrive in the notebook with the deleted files.
Ed

User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#37 by Rava » 07 Oct 2023, 04:50

Ed_P wrote:
07 Oct 2023, 04:41
It doesn't list any of the deleted files.
That is normal. As soon as recovery starts you will get in the chosen target directory / target partition many folders with tons of files all named like f00000123.ext where ext is the assumed extension based on its contents and f stands for file , while the following number is just counting up from 1 to the amount of total recovered files.

Example, I chose an external ESATA drive as target. And the folder /backup/ in its root as base folder.
The folders and files where created like so:

Code: Select all

backup/recup_dir.1/f0000336.html
backup/recup_dir.1/f0000280.txt
backup/recup_dir.1/f0000104.txt
[…]
backup/recup_dir.88/f0002436.jpg
backup/recup_dir.88/f0002437.com
and so on.

Added in 3 minutes 11 seconds:
Because there will be TONS of such sub-folders, using the root folder of your target partition is not recommended, create a sub-folder.

Let's assume sdb2 is your target partition.
Do not use /mnt/sdb2 as target folder

Create e.g. /mnt/sdb2/recovery/ and choose /mnt/sdb2/recovery/ as target folder

Good luck. :)
Cheers!
Yours Rava

User avatar
Ed_P
Contributor
Contributor
Posts: 8374
Joined: 06 Feb 2013, 22:12
Distribution: Cinnamon 5.01 ISO
Location: Western NY, USA

Help! I somehow deleted Windows files that I need

Post#38 by Ed_P » 07 Oct 2023, 05:06

I don't see Recovery as an option.

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, August 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
     MS Data                500084736 1024372735  524288000 [Data]
Directory /

>dr-xr-xr-x     0     0         0  6-Oct-2023 11:33 .
 dr-xr-xr-x     0     0         0  6-Oct-2023 11:33 ..
 dr-xr-xr-x     0     0         0 30-Sep-2023 02:59 $RECYCLE.BIN
 dr-xr-xr-x     0     0         0 18-Sep-2023 11:52 ISOs
 dr-xr-xr-x     0     0         0 18-Sep-2023 12:05 System Volume Information
 dr-xr-xr-x     0     0         0 18-Sep-2023 12:01 Users
 dr-xr-xr-x     0     0         0 18-Sep-2023 11:52 porteus5.0












                                                   Next
Use Right to change directory, 'h' to hide Alternate Data Stream
    'q' to quit, ':' to select the current file, 'a' to select all files
    'C' to copy the selected files, 'c' to copy the current file
And the folders shown are mostly empty.

The sdb6 drive is totally empty so I don't think creating a recovery folder is needed. And testdisk is running as root.
Ed

User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#39 by Rava » 07 Oct 2023, 05:14

Ed_P wrote:
07 Oct 2023, 05:06
The sdb6 drive is totally empty so I don't think creating a recovery folder is needed.
You do know the capacity of holding entries in the root folder is limited?
Whereas adding capacity for any non root folder is possible.
But if you know better than me, ignore my advice. When creating one single folders is too much work for you to be on the safe side, be my guest. Image
I always choose better safe that sorry when that option is possible, but why follow my silly ideas?
Ed_P wrote:
07 Oct 2023, 05:06
I don't see Recovery as an option.
You can recover files to a different partition, but I do not recall how that option is phrased exactly. Read all my old posts about the older

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, Novembre 2020
version on here.
But use the most recent version, as of now, the one you have -

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, August 2023
is the most up-to-date, unless there was a new version in the last few weeks. (I doubt that)

And in any doubt, use the forum as provided by cgsecurity.org - there are the experts on using testdisk.
I went there myself back in 2020, because data recovery is serious business, better be double and triple prepared than do one single mistake that might make the data loss even worse.
But then again, why follow Rava's silly ideas?

About forums as provided by cgsecurity.org - that included Christophe Grenier himself. (No guarantee on that, he might be unavailable.)
Cheers!
Yours Rava

User avatar
Ed_P
Contributor
Contributor
Posts: 8374
Joined: 06 Feb 2013, 22:12
Distribution: Cinnamon 5.01 ISO
Location: Western NY, USA

Help! I somehow deleted Windows files that I need

Post#40 by Ed_P » 07 Oct 2023, 05:28

I may be making progress.

Code: Select all

TestDisk 7.2-WIP, Data Recovery Utility, August 2023
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
 7 P MS Data                500084736 1024372735  524288000 [Basic data partition] [Data]
Deleted files

>!CMD here.cmd                                                       16-May-2007 13:25          38
 !cmd_here.cmd                                                       18-Apr-2022 18:06         333
 !cmd_here.cmd                                                       13-Mar-2019 18:24         283
 !custom/!custom_nu2menu.xml                                         12-Jun-2013 12:16         809
 !custom/BartPE CD cover.bmp                                         23-Sep-2011 13:51      629334
 !custom/Eds.bmp                                                     13-Mar-2006 01:16     1440054
 !custom/OemLogo.bmp                                                  5-Sep-2001 02:04       40422
 !custom/addSystem2Admin.cmd                                         12-Jun-2013 11:31          41
 !custom/custom.htm                                                   3-Jan-2005 12:47         316
 !custom/custom.inf                                                  12-Jun-2013 12:06        6590
 $I0RUGBQ.xyzm                                                       29-Jun-2023 12:38         120
 $I2MICTM.jpeg                                                        8-Sep-2023 01:13         156
 $I39S0PC.zip                                                        24-Jun-2023 11:22          88
 $I3IBQRN.xyzm                                                        3-Jul-2023 10:31         154
 $I41SIU7.xyzm                                                       29-Jun-2023 12:38         128
 $I9IDKO7.jpeg                                                        8-Sep-2023 01:13         164
 $I9RB6UM.jpeg                                                       28-Jun-2023 11:39          94
 $IA64MYU.fuse_hidden0000000300000002                                28-Jun-2023 11:28         102
 $ICBJI4L.xyzm                                                       29-Jun-2023 02:10         142
 $IFLU756.xzm                                                        29-Jun-2023 12:38         134
                                                   Next
Use : to select the current file, a to select/deselect all files,
    C to copy the selected files, c to copy the current file, q to quit
But the names concern me. What a mess and with thousands of files. :wall:

Added in 7 minutes 50 seconds:
Rava wrote:
07 Oct 2023, 05:16
You do know the capacity of holding entries in the root folder is limited?
Whereas adding capacity for any non root folder is possible.
No, I was not aware that root folders had limits and I'm not knowledge enough to know that an empty drive is treated as root unless a folder is created on it.

Added in 4 minutes 53 seconds:

Code: Select all

guest@porteus:/mnt/sdb6$ ls
Recovery/
guest@porteus:/mnt/sdb6$ 
Ed

User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#41 by Rava » 07 Oct 2023, 05:44

Ed_P wrote:
07 Oct 2023, 05:28
But the names concern me. What a mess and with thousands of files. :wall:
Like I said, testdisk will create tons of files with a large number of folders , therefore creating a sub-folder is recommended.
Because the root of all partitions has limited capacity holding entries.

But it's your choice.
And I would always go the "select all" files any try to recover all files. What you see, filename wise might be inaccurate, better to recover lots if unimportant files (that can be deleted afterwards) than to miss a few very important ones. And it will take hours regardless since testdisk has to go over the whole lost partition and read the whole lost partition anyway.
Ed_P wrote:
07 Oct 2023, 05:36
No, I was not aware that root folders had limits and I'm not knowledge enough to know that an empty drive is treated as root unless a folder is created on it.
The root of any partition (e.g. /mnt/sda1/ ) has limitations, while a folder, any folder in it (e.g. /mnt/sda1/sillyfolder/ ) has not. Unless the limitations of the chosen file system apply, of course, but I presume you chose an ext2 or ext3 filesystem as target? Or at least NTFS and not VFAT.
Ed_P wrote:
07 Oct 2023, 05:41

Code: Select all

guest@porteus:/mnt/sdb6$ ls
Recovery/
guest@porteus:/mnt/sdb6$ 
Good. :good:
Cheers!
Yours Rava

User avatar
Ed_P
Contributor
Contributor
Posts: 8374
Joined: 06 Feb 2013, 22:12
Distribution: Cinnamon 5.01 ISO
Location: Western NY, USA

Help! I somehow deleted Windows files that I need

Post#42 by Ed_P » 07 Oct 2023, 05:45

I gotta rethink this. Going to bed.
Ed

User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#43 by Rava » 07 Oct 2023, 05:47

Ed_P wrote:
07 Oct 2023, 05:45
I gotta rethink this. Going to bed.
Good idea, rethink everything, and be rested. Starting that half asleep would be a bad start.
See you later alligator.
Cheers!
Yours Rava

User avatar
Ed_P
Contributor
Contributor
Posts: 8374
Joined: 06 Feb 2013, 22:12
Distribution: Cinnamon 5.01 ISO
Location: Western NY, USA

Help! I somehow deleted Windows files that I need

Post#44 by Ed_P » 08 Oct 2023, 06:04

A GParted scan of the problem drive.
Image
Yet they show as NTFS.

I can't get testdisk to copy the selected files to the USB drive's /mnt/sda6 drive. All the listed folders are Porteus live folders.
Image
Rava wrote:
07 Oct 2023, 05:44
I presume you chose an ext2 or ext3 filesystem as target? Or at least NTFS and not VFAT.
The drive is NTFS. It's from a old Windows system.

And I'm off to bed. :)

Added in 13 hours 37 minutes 13 seconds:
Ed_P wrote:
08 Oct 2023, 06:04
I can't get testdisk to copy the selected files to the USB drive's /mnt/sda6 drive.
I figured it out.
Ed

User avatar
Rava
Contributor
Contributor
Posts: 5416
Joined: 11 Jan 2011, 02:46
Distribution: XFCE 5.01 x86_64 + 4.0 i586
Location: Forests of Germany

Help! I somehow deleted Windows files that I need

Post#45 by Rava » 08 Oct 2023, 22:56

Ed_P wrote:
08 Oct 2023, 19:41
I figured it out.
Tell us so others can learn from your experience.

Anyhow, I presume the PC is working and copying / recovering files right now?
Cheers!
Yours Rava

Post Reply