ext4 recovery (extundelte error: malloc(): invalid next size (unsorted))

Question

After accidentally deleting mp4 files I created an image of the mounted 5-TB-partition for recovery. It has been quite some time between deletion and imaging, as I did not notice the issue very quickly. Now I try several ways to recover. As undelete files on ext4 is pretty dated I created a new post.

1. extundelte aborts at stage

   Loading journal descriptors
   

   with the error

   malloc(): invalid next size (unsorted)
   

   The (virtual) system I use for recovery has 10 GB of RAM and before the crash only about 500MB are used, so I do not think the cause is "not enough RAM".

   This bug(?) may have been reported before on fedora/red hat but it seems like sadly it was not fixed there either.

2. ext4magic: The filelisting created by

   -a NNNNNNNNNNNN -f / -l
   

   does not include the relevant files, so the journal seems to have been cleaned in between.

3. PhotoRec/Carving did recover some files but playback is possible only for parts of the media, so it seems that the files have been fragmented in the file system and PhotoRec cannot handle that.

Does anybody have any idea for further options? I have some broader ideas, but did not yet find a method/tool to try these:

• Advanced Carving methods that can cope with fragmentation (I only found tools for small flash media, not for large disks)
• Recovery of the previous journal? (e.g. by carving, but most likely overwritten by the new journal I think)
• Recovery based on non-reused inodes (how many information remain at the inodes after deletion until they are reused?)

Thanks for reading

More resources I found already:

• Undelete a just-deleted file on ext4 with extundelete
• Ooooops or how to undelete a file on an ext4 filesystem

I use Lubuntu 20.04.

Answer 1

Check your usage of the command.

On my (PCLINUXOS) box, extundelete specifies

extundelete {switches} [--] device-filename 

and I got the same error as you when I typed it in the format

extundelete /dev/sda4 -o /path-to-destination -restore-all

Of course AFTER I typed it in correctly, the command still didn't work, I got a different error message that I didn't catch because of the limited singleuser console login mode I was using, and now can't seem to replicate!