Data recovery

[Susan Cragin]

Thank you for the advice! 
I followed the instructions and got a lot of files back, including the school files for my current semester (I'm a teacher) and the stuff I really can't live without. 
What I didn't get from my SSD was two sets of files, my txt and org files, which are mostly very small, and my epub files. Both sets of files were stored together, and I suspect they were over-written and are gone for good. The epubs I don't mind, and the txts/org I can live without. 
Interesting process. Harder to get stuff back from an SSD. 
I also got a suggestion through the Debian list to use hb4most as a front-end for scalpel and foremost. I'm going to try that in a week or so and see if I can retrieve anything else.
Will let you know if I'm successful.
Thanks again,
Susan

-----Original Message-----
From: Dan Garthwaite 
Sent: Feb 16, 2016 11:58 AM
To: Matt Minuti 
Cc: Susan Cragin , GNHLUG-discussion 
Subject: Re: Data recovery

dd if=/dev/sda2 | gzip > /mnt/external/mydrive.img.gz

Or my pref:
apt-get install pv
pv -peat -B 10240 /dev/sda2 | gzip > /mnt/external/mydrive.img.gz

On Tue, Feb 16, 2016 at 11:46 AM, Matt Minuti <matt.minuti at gmail.com> wrote:
I did the same thing for the first time last spring and actually managed to save everything! Spinning platter, ext4. Here's the process I used, for everyone's future reference. Hopefully it helps, good luck!

First thing I did was boot up a live usb and dd the partition to an image on an external hard drive (good practice to not mess with the original any more than necessary). `dd if=/dev/sda2 of=/mnt/external/mydrive.img`

Next I used ext4magic (https://sourceforge.net/projects/ext4magic/ with usage scenarios stuff at http://ext4magic.sourceforge.net/howto_en.html), which is based on ext4undelete but seemed better to me, probably because you can easily recover only files deleted within a certain timeframe, so you don't have a ton of junk dredged up.

Example:
Files deleted roughly 2 days ago, recovering everything after 3 days ago and before 1 day ago, recovering from the backup image.
ext4magic -R -a $(date -d "-3day" +%s) -b $(date -d "-1day" +%s) -d /mnt/external/recovered_files_here/ /mnt/external/mydrive.img

Afterwards, I used fslint to search for duplicates and help me figure out which copy of the file to keep. Partly because fslint is really awesome, partly because I was really low on space at this point...


On Tue, Feb 16, 2016 at 9:40 AM, Susan Cragin <susancragin at earthlink.net> wrote:


It is an ssd but I'm going to try. What the heck. My favorite files are a cluster of small txt and org files. And I haven't used the machine since then.


-----Original Message-----

>From: Joshua Judson Rosen <rozzin at hackerposse.com>

>Sent: Feb 16, 2016 9:31 AM

>To: Susan Cragin <susancragin at earthlink.net>, GNHLUG-discussion <gnhlug-discuss at mail.gnhlug.org>

>Subject: Re: Data recovery

>

>On 02/16/2016 09:22 AM, Susan Cragin wrote:

>>

>> I recursively deleted my home folder, "susan."

>> I have days-old backup but want to try data recovery.

>

>Is this on a spinning-platter HDD, or on one of those

>new-fangled SSDs?

>

>As far as I understand it, you're unlikely to be able

>to recover any data from an SSD as they're so aggressive

>about remapping logical/physical blocks.

>

>

>--

>"Don't be afraid to ask (λf.((λx.xx) (λr.f(rr))))."