2

I accidentally moved a file onto an existing file and need to recover the old file.

original file: /mnt/FILE (was around 1 GB)

new file: /mnt/FILE (now is 17 bytes)

command:

mv SOMEFILE /mnt/FILE

First I have unmounted the filesystem the file resides on, i.e. 

umount /mnt

Ran a hdparm --fibmap on the updated /mnt/FILE to get the following:

 filesystem blocksize 4096, begins at LBA 0; assuming 512 byte sectors.
 byte_offset  begin_LBA    end_LBA    sectors
           0  342898376  342898383          8

I am trying to run a dd on the device where /mnt/FILE is (/dev/xvdb) to copy out the blocks from the larger file:

dd if=/dev/xvdb of=/tmp/FILE bs=4096 skip=342898376 count=1000000000 iflag=skip_bytes,count_bytes

I don't seem to be getting the right blocks, could you please advise me how to do so.

techraf
  • 4,403
user2778214
  • 21

1 Answers1

2

What is the filesystem ?

If it's ext3 (with journaling enabled) or ext4, you can try extundelete.

I also don't understand your data attempt recovery. Why do you try to recover the first GB from the partition ?

pistache
  • 225