1

I have a ddrescue image containing data from a Btrfs partition whose first GBs were overwritten. Therefore, the filesystem cannot be mounted, so the files cannot be accessed through any filesystem as such — only as raw data. I have already tried using TestDisk / PhotoRec to carve out data from this dd image, and I was able to recover many files. Yet, what I now need is to able to explore this dd image more thoroughly, and interactively (as opposed to using some automated file recovery software). How can I do it?

0

Here’s a rough idea to get you started:

  • Create an (empty) filesystem that’s as similar as possible to the one that was clobbered.  I guess making it the same size is probably fairly important; try to replicate as many other parameters as you can remember, recover, or reconstruct.
  • Estimate how much of your filesystem got overwritten; let’s say that it was 3 GB.
  • Make a copy of your image, and overwrite its first 3 GB with the first 3 GB of the empty filesystem.
  • See what progress you can make on that hybrid image.

At first I was going to suggest that you use debugfs, but then I recalled that it supports only ext2/ext3/ext4 filesystems.  But see if you can find tools that handle your filesystem type.  Try searching for “computer forensic tools”.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.