2

I accidentally moved a file onto an existing file and need to recover the old file.

original file: /mnt/FILE (was around 1 GB)

new file: /mnt/FILE (now is 17 bytes)

command:

mv SOMEFILE /mnt/FILE

First I have unmounted the filesystem the file resides on, i.e. 

umount /mnt

Ran a hdparm --fibmap on the updated /mnt/FILE to get the following:

 filesystem blocksize 4096, begins at LBA 0; assuming 512 byte sectors.
 byte_offset  begin_LBA    end_LBA    sectors
           0  342898376  342898383          8

I am trying to run a dd on the device where /mnt/FILE is (/dev/xvdb) to copy out the blocks from the larger file:

dd if=/dev/xvdb of=/tmp/FILE bs=4096 skip=342898376 count=1000000000 iflag=skip_bytes,count_bytes

I don't seem to be getting the right blocks, could you please advise me how to do so.

techraf
  • 4,163
  • 8
  • 27
  • 44
9o9
  • 21
  • 4

1 Answers1

2

What is the filesystem ?

If it's ext3 (with journaling enabled) or ext4, you can try extundelete.

I also don't understand your data attempt recovery. Why do you try to recover the first GB from the partition ?

pistache
  • 225
  • 1
  • 6
  • 1
    Thanks for your response. It is ext4. I could be mistaken but the skip parameter is an offset to start from, i.e. 1gb from there. – 9o9 Aug 12 '16 at 20:38
  • Yes, you are reading 1GB from the beginning of the partition. `xvdb` is the device, and `342898376` is the partition. If it's ext4, **don't keep it mounted in read-write** (or dump it to a safe place), and use extundelete (`photorec` could also help if it's a known file format). – pistache Aug 12 '16 at 20:41
  • What is the format of the original file ? – pistache Aug 12 '16 at 20:59
  • Try `photorec` ! – pistache Aug 12 '16 at 21:12