Page 1 of 1

Recover file Presumably Truncated by App

Posted: 27 Mar 2017, 18:57
by Bogomips
It happened that the browser PaleMoon for some reason failed to start download of the file, so attempted a second time which succeeded. When download green arrow showed went to check if completed correctly or error termination, both of which result in green arrow, misleading!

After some two hours it was just about finished downloading 600M from filesharing site. Saw the download had been truncated, so hit restart in order to get the last few megs downloaded. To my consternation showed only 50K downloaded! Looked further down saw entry of a finished download of 600M with same file name. Sinking feeling in pit of stomach. Cancelled failed download. File nowhere to be found in folder. Searched web for deleted file recovery, and found two promising methods.
  1. lsof

    Code: Select all

    lsof  |  grep  filename
    Produced nothing.
  2. TestDisk https://itsfoss.com/recover-deleted-files-linux/
    However in Step 8 of the link, did not get option to delete. Only got: [Type] [Image] [Creation] [Quit].
    So leading one to suspect file was not deleted but truncated, and that differnet approach needed.

    TestDisk was installed with USM, had missing ntfs-3g library dependency. Also of interest was an entry for PhotoRec in menu. It appears one also gets PhotoRec thrown in when one installs TestDisk.
Further Deliberation Since this is a big file filesystem, only made a handful of deletes, probably no more than five files deleted. Therefore an easy solution would be to go through the inodes searching for orphans and retrieving inodes of 600M size. Would be interested to know if this is feasible, and how to find unused inodes. Any one know this off the top of their heads?

More Precisely Need to be able to iterate thru all used inodes in order to find the orphaned ones for comparison.