Recover file Presumably Truncated by App

Technical issues/questions of an intermediate or advanced nature.
Bogomips
Full of knowledge
Full of knowledge
Posts: 2564
Joined: 25 Jun 2014, 15:21
Distribution: 3.2.2 Cinnamon & KDE5
Location: London

Recover file Presumably Truncated by App

Post#1 by Bogomips » 27 Mar 2017, 18:57

It happened that the browser PaleMoon for some reason failed to start download of the file, so attempted a second time which succeeded. When download green arrow showed went to check if completed correctly or error termination, both of which result in green arrow, misleading!

After some two hours it was just about finished downloading 600M from filesharing site. Saw the download had been truncated, so hit restart in order to get the last few megs downloaded. To my consternation showed only 50K downloaded! Looked further down saw entry of a finished download of 600M with same file name. Sinking feeling in pit of stomach. Cancelled failed download. File nowhere to be found in folder. Searched web for deleted file recovery, and found two promising methods.
  1. lsof

    Code: Select all

    lsof  |  grep  filename
    Produced nothing.
  2. TestDisk https://itsfoss.com/recover-deleted-files-linux/
    However in Step 8 of the link, did not get option to delete. Only got: [Type] [Image] [Creation] [Quit].
    So leading one to suspect file was not deleted but truncated, and that differnet approach needed.

    TestDisk was installed with USM, had missing ntfs-3g library dependency. Also of interest was an entry for PhotoRec in menu. It appears one also gets PhotoRec thrown in when one installs TestDisk.
Further Deliberation Since this is a big file filesystem, only made a handful of deletes, probably no more than five files deleted. Therefore an easy solution would be to go through the inodes searching for orphans and retrieving inodes of 600M size. Would be interested to know if this is feasible, and how to find unused inodes. Any one know this off the top of their heads?

More Precisely Need to be able to iterate thru all used inodes in order to find the orphaned ones for comparison.
Last edited by Bogomips on 28 Mar 2017, 01:02, edited 1 time in total.
Reason: More Precisely
Linux porteus 4.4.0-porteus #3 SMP PREEMPT Sat Jan 23 07:01:55 UTC 2016 i686 AMD Sempron(tm) 140 Processor AuthenticAMD GNU/Linux
NVIDIA Corporation C61 [GeForce 6150SE nForce 430] (rev a2) MemTotal: 901760 kB MemFree: 66752 kB