Data Recovery and Disk Utilities Forum @R-TT

Hello,

I just tried R-Linux to recover a directory that has been accidentally deleted from a NAS (connected as a network unit) with SHIFT+DEL in Windows 7. NAS is RAID 1 formatted ext4.

I removed one disk from the NAS and connected it to my laptop with a USB docking station. I tried Basic file recovery and after 'Open Drive Files' I could read the drive content. I expected to see the directory name labeled as deleted, but nothing: only existing files and directories are listed. Is there something I'm missing about how R-Linux works?

Thanks for your attention, and regards.

Check that Deleted files and Show empty folders are enabled on the File Mask dialog box. If this doesn't help, try to scan the disk.

Alt wrote:Check that Deleted files and Show empty folders are enabled on the File Mask dialog box. If this doesn't help, try to scan the disk.

Hi,

Thanks for your answer. I repeated all the operations to be sure not to miss something.

Open Drive Files displays the directory tree of the selected partition, with all existing files. Except for files deleted by the NAS during its operations, the only files deleted by myself since I bought the NAS are in a directory named '_ acta', which is not displayed.
At this point, I can click on the Define Mask icon. I select Show Empty Folders and Deleted files, deselect Existing files. Now only a subset (*) of the previous directory tree is displayed, and '_ acta' is still not included in the list.
I mark the directory 'D' which should contain '_ acta' and choose Recover Marked. In the dialog box Condensed..., Restore folder structure, Recover alternative..., Recover extended attributes are selected, Ignore file mask unselected.
After the recovery the output directory contains a lot of folders and files (*): I checked some of them and they are all copies of existing files on the disk. '_ acta' and its content are not among them.

(*) The files copied in the output directory look the same that are displayed after Define Mask in the directory 'D' which should contain '_ acta'.

For comparison, I ran extundelete from SystemRescueCD, with the --restore-all option. It detects recoverable inodes and recovers the - seemingly whole - content of '_ acta', along with a few other files that were deleted by the NAS.

Now I have recovered my files with extundelete, but the problem with R-Linux is still interesting by itself. I don't know how R-Linux works, but it seems as if the program somehow matched recoverable inodes to the wrong files (just a faint hypothesis based on the fact that some files and folders are copied in the output directory).

If the following information may be of any help, in case you wanted to reproduce the problem, I ran R-Linux on a Western Digital WD20EFRX removed from a RAID 1 array on a QNAP TS-212 NAS, connected to my laptop via USB with an Orico docking station.

Best regards.

Did you scan the disk?

Alt wrote:Did you scan the disk?

I did it yesterday and don't remember having seen different results, but scanning 2 TB takes a lot of time. Just to be sure, tomorrow I'll try to define a region and scan the first 300 GB or such. The disk contains about 250 GB of files, that are likely to be found in the first 300GB (fragmentation should be minimum) so scanning this region should be equivalent to scanning the whole drive.

I recommend you to save scan results while scanning.

Alt wrote:I recommend you to save scan results while scanning.

Today I scanned the partition.

Start: 0
Size: 300 GB
Ext2/3/4
Extra search for known file types
Save to file
Scan view: none (fastest)

Enumerate files for Recognized0 1,82 TB shows the whole disk content, as before, without the deleted directory.
After File Mask, the same result as previously stated: a certain number of existing files (same files as before) are found and marked as deleted.

If my hypothesis about inodes were correct, I'd expect the files recognized by R-Linux to be the same number as those recovered by extundelete: instead, the two numbers are different.