How to recover data from an ext4 partition mounted incorrectly?

Question

I was in the process of rsyncing data from /mnt/disk1 to /mnt/disk2 and had already modified fstab to remount /mnt/disk1 as /tmp. I didn't pay attention to the progress of the rsync and during the process some parts arrived for the system so I shut it down to install them. I know this is my own stupid fault, in 15 years I've never lost data like this so I'm venturing down a new trail.

Is there any way to recover the data in it's original structure and names? A total of 64K was written to the disk while mounted as /tmp. I'm running PhotoRec right now but the recovered data is not very usable (recup_dir.32/f03183747.txt as an example)

Possible duplicate of Is there any recovery software available for ext4? — Fabby, Jul 10 '19 at 18:12
I'm not looking for recovery software in general. I can recover the data, what I'm looking for is software that will recover the names and directory structure as well. — Jarad Downing, Jul 10 '19 at 19:47
TeskDisk helped me a couple of days back. It is a bit hard to figure out. But in the end, it gave the drive as it is. — user227495, Jul 11 '19 at 06:59
@user227495 I tried out TestDisk but since the partition had been mounted and written to (only 64K) it didn't solve my problem. I only guess that it was due to being mounted and written to, I may have not been using it correctly. — Jarad Downing, Jul 11 '19 at 17:44

Fabby · Accepted Answer · 2019-07-11T06:31:55.567

0

Do not write to disk1 any more: use it for reading only.
If you need to do writes, make a copy first using ddrescue and write to the copy only.
```
apt install gddrescue
man ddrescue
```
If disk1 contains an ntfs file system, use RecuperaBit first!
As ntfs contains multiple MFTs, you might recover some or all of the directory structure.
If you arrive at this step, you probably have EXT2/3/4 FS on your disk. Recovering the directory structure is going to be difficult if both superblocks are overwritten: try this first on the copy you made from the original disk.
Use TestDisk before you use PhotoRec
Use autopsy before you use PhotoRec
Use R-Disk before using PhotoRec
Only if all else fails, start using PhotoRec

The best solution here is to restore your backup thought and if you don't have a backup, start making a backup ASAHP

edited Jul 11 '19 at 06:31

answered Jul 10 '19 at 18:12

Fabby

34,259

It's ext4 - wish it was zfs or it was in a raid :( – Jarad Downing Jul 10 '19 at 21:33
RAID is not a replacement for a backup: it just replicates the same mistake over multiple drives. – Fabby Jul 11 '19 at 06:29
true, I was thinking along the lines of gluster. Anyway none of the software you mentioned was able to do what I needed. In the end I just recreated the files that I absolutely had to have and will keep the image I created around if I notice something else missing. Since you supplied an answer that, while didn't solve my problem, did provide something like PhotoRec to recover some data (all others failed). – Jarad Downing Jul 11 '19 at 17:41
Sorry to hear that, thanks for the acceptance, favour returned: question upvoted! – Fabby Jul 11 '19 at 18:39

How to recover data from an ext4 partition mounted incorrectly?

1 Answers1

Linked