0

What is the best way to recover deleted zip files from a specific path ? I have 2 zip files previously stored in an ext drive in /dev/sda3 to be cut&pasted to home/user/Documents. These zip files have keyword "class" in their filename, one of them was around 2GB in size and the other one was less in size, I remember this much. Just in case restoring a folder is possible, I did extract them as well, but the extracted folder was deleted since the zip files was available anyway. Later on, these zip files accidentally got deleted as well. If this information helps, these files got deleted less than a week ago. Trash bin is empty.

I came across this thread : How to recover deleted files? and tried whatever I can try from the solution section. What have I tried :

  1. R-linux : Can't find those zip files, both from/dev/sda3 or home/user/Documents. In fact, there was no zip files found with size more than 1GB.

  2. Photorec : Can't find specific zip files, both from/dev/sda3 or home/user/Documents after 18 hours of recovering. But I obtained an unknown 960-ish GB zip files that I can't seem to extract due to errors that I can't seem to get around yet :

    ERRORS:                                                                                                                           
Headers Error                                                                                                                     
Unconfirmed start of archive

    WARNINGS:
    
There are data after the end of archive
    

    --
    
Path = f7915520.zip
Type = zip
ERRORS:
Headers Error
Unconfirmed start of archive
WARNINGS:
There are data after the end of archive
Physical Size = 8453482
Tail Size = 996119120534

I tried unzip this using unzip, p7zip and java archiver (following this answer), all came across similar errors. Force unzip was not possible

  1. extundelete : I have tried unmounting /dev/sda3 and run this command sudo sudo extundelete /dev/sda3 --restore-file ".*class.*\.zip" and came across this output :

    NOTICE: Extended attributes are not restored.                                                                                     
Loading filesystem metadata ... 2407 groups loaded.                                                                               
Loading journal descriptors ... 0 descriptors loaded.                                                                             
extundelete: Extent block checksum does not match extent block while finding inode for .*class.*\.zip
extundelete: Extent block checksum does not match extent block while finding inode for .*class.*\.zip
Failed to restore file .*class.*\.zip
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name                                       | Inode number | Deleted status
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem

sudo extundelete /dev/sda3 --restore-file '\.zip$' returns the same output.

  1. These files weren't removed using rm, so history | grep "rm .*class.*\.zip" returns nothing
  2. foremost. I tried to run sudo foremost -v -t zip -q -i /dev/sda3 -o /media/user/external/recover -T . Bunch of zip files were found, but specific ones are not there. To my observation, similar to R-linux, big-sized zip files are not recovered, the biggest being 100mb only.

I appreciate any suggestions for other tools or to address errors I mentioned above. Anything I can try.

raisa_
  • 391

0 Answers0