I am using scalpel to recover an accidently deleted rar file which is 476 MB in size. I have the following config setting to recover rar files:
rar n 10000000000000000000 Rar!
and running the following command:
sudo scalpel /dev/sda1 -o ./recovered/
it shows the following result:
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
Opening target "/dev/sda1"
Image file pass 1/2.
/dev/sda1: 100.0% |*********************************************************| 476.0 MB 00:00 ETAAllocating work queues...
Work queues allocation complete. Building carve lists...
Carve lists built. Workload:
rar with header "x52x61x72x21" and footer "" --> 1 files
Carving files from image.
Image file pass 2/2.
/dev/sda1: 100.0% |*********************************************************| 476.0 MB 00:00 ETAProcessing of image file complete. Cleaning up...
Done.
But when I browse the recovered
folder as root and check the size of the recovered rar it says it is only 42.1 MB in size. How can I recover the whole RAR file? Please Help.