I was making some room n my file server by moving the data to the desktop. The desktop had a catastrophic failure and now i'm trying to recover the files from the fileserver. Trying to undelete close to 4tb of data from ext4 partition.
Here's the setup... 5 disk raid 6 (17TB used out of 22 TB total). This mounts a LUKS partition, with an underlying EXT4 partition.
The EXT4 partition is perfectly readable, and I've set it to readonly. Between the time of deletion and setting it to readonly, nothing has been written or moved around on the file server. it has been rebooted once, and that was to reboot with the ext4 as readonly.
Can't image the disk because its 22TB. The desktop is back up and running and has 8TB free space, so I have mounted part of the file system inside the file-server's file system to have a place to write the large amount of data i need to recover.
I found testdisk and it looks perfect for my use case. I can see the deleted folders, but they all appear empty.
How can I get my deleted files back? and preferably the underlying folder structure they live in?
Please help.
I tried, undelete files on ext4 , but haven't been able to un-delete folders with all original files that were in it. I suspect the mentioned post did not delete the actual /tmp folder.
Also read: Testdisk brings back empty folders that take up space and data recovery with testdisk , but I suspect these have to do with a windows-fs and not linux/ext4-fs.
