I accidentally deleted a zstd compressed image of a drive that I backed up. That drive has been put to use elsewhere, so is little chance I can recover the original partitions from it.

I immediately unmounted the backup drive I had the image stored on and it has not been written to since. It contains an LVM physical partition with a single LUKS encrypted ext4 volume.

I’ve tried using photorec on the ext4 volume, but it seems to be recognizing files that were inside the compressed image, and not the image itself. Text files that are “recovered” contain many invalid characters, and other filetypes are unusable.

While I could cut my losses now and move on without that backup image, I would prefer if I could recover it and the data inside. I’ve looked elsewhere across the internet, and haven’t found any useful information regarding whether this is possible or not.

  • Romkslrqusz@lemmy.zip
    11·
    3 days ago

    I don’t know that PhotoRec was the ideal place to start for this case, as it is file signature based and will scrape for an insane number of results.

    I recommend that you give DMDE a shot, run a full scan of your disk and then have a look through the FS Reconstruction with deleted files included.

    • Yttra@lemmy.world
      8·
      3 days ago

      I second this!

      I just discovered DMDE last week while trying to recover some save files from a corrupted exfat micro SD. File signature tools sure found all my screenshots and audio files I didn’t care about, but only DMDE caught what I was looking for.

  • sylver_dragon@lemmy.worldEnglish
    4·
    3 days ago

    You could try using Autopsy to look for files on the drive. Autopsy is a forensic analysis toolkit, which is normally used to extract evidence from disk images or the like. But, you can add local drives as data sources and that should let you browse the slack space of the filesystem for lost files. This video (not mine, just a good enough reference) should help you get started. It’s certainly not as simple as the photorec method, but it tends to be more comprehensive.

  • just_another_person@lemmy.world
    3·
    3 days ago

    Depends on when you deleted it and how much activity time on that drive has passed. If it’s just an ext4 drive and you haven’t had a large number of changes to that partition since it’s been deleted, some different recovery tools may find it.

    Photorec is pretty capable though, so if it’s not finding it, that’s probably the end of that.