Sample Header Ad - 728x90

How to find orphan directory entries in a ext4 disk

3 votes
1 answer
2317 views
This comes from a long story of trying to recovering a TrueCrypt volume from a hardware failure (thanks, WD). I ended up with an unencrypted 3TB image that had the files that I want to recover. Unfortunately, after using testdisk and extundelete, I guessed the directory entry that leads to the descriptors (of the additional directories) that I want to recover has been overwritten. However, I think that its subdirectories may have their entries still intact. I would like to know how can I search throughout the disk image for directory entries in unallocated blocks, in order to recover their files (with their proper names, which would be much better than using foremost, photorec and the like). I know that extundelete with a default --recover-all doesn't look further than the tree that spawns from the root directory. Okay, what if one of the branches is broken but I know that the subfolders entries are somewhere? Just in case I didn't express myself clearly, imagine that the entry lost is [root]/information. The root directory has the 'information' entry, but it points to overwritten data. Its directory entry is gone, but I want to scan for its subdirectories, [root]/information/personal, and [root]/information/business, and so on. (the name of those subdirectories was in the 'information' entry- I don't care about that name but their whole structure)
Asked by huff (131 rep)
Mar 4, 2014, 12:14 AM
Last activity: May 7, 2025, 03:07 AM