Sunday, May 5, 2024
 Popular · Latest · Hot · Upcoming
3
rated 0 times [  3] [ 0]  / answers: 1 / hits: 1163  / 3 Years ago, wed, october 13, 2021, 5:57:49

I am using scalpel to recover an accidently deleted rar file which is 476 MB in size. I have the following config setting to recover rar files:



   rar     n       10000000000000000000        Rar!


and running the following command:



sudo scalpel /dev/sda1 -o ./recovered/


it shows the following result:



Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.

Opening target "/dev/sda1"

Image file pass 1/2.
/dev/sda1: 100.0% |*********************************************************| 476.0 MB 00:00 ETAAllocating work queues...
Work queues allocation complete. Building carve lists...
Carve lists built. Workload:
rar with header "x52x61x72x21" and footer "" --> 1 files
Carving files from image.
Image file pass 2/2.
/dev/sda1: 100.0% |*********************************************************| 476.0 MB 00:00 ETAProcessing of image file complete. Cleaning up...
Done.


But when I browse the recovered folder as root and check the size of the recovered rar it says it is only 42.1 MB in size. How can I recover the whole RAR file? Please Help.


More From » 12.10

 Answers
5

This may be due to the inability of the recovery software, scalpel. So its a better idea to use other recovery tools like r-linux , photorec



R-Linux is a free file recovery utility for the Ext2/Ext3/Ext4 FS file system used in the Linux OS and several Unixes.



Which partition is used for storing recovered data from sda1?


update


It's a bad idea to recover the data to the same partiton. The golden rule is never write to a data lost partition until it is recovered. So boot into a live CD, mount the partition in RO, recover to another storage like a pen drive. If you don't have a external storage and have 1.5+ GB of RAM recover data to RAM. Ubuntu uses RAM for /tmp. If you are not sure mount some portition of the RAM at /mnt using sudo mount -t tmpfs tmpfs /mnt -o size=600M


[#24369] Wednesday, October 13, 2021, 3 Years  [reply] [flag answer]
Only authorized users can answer the question. Please sign in first, or register a free account.
gigglcept

Total Points: 113
Total Questions: 105
Total Answers: 125

Location: Christmas Island
Member since Wed, Jan 13, 2021
3 Years ago
;