<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>At the moment, I have ddrescue making an image of the drive
(estimate 6hours 30min). Next it looked like photorec might be
good to use, but I haven't gotten into it yet to know. From what I
can tell, it comes with Testdisk and that is the tool that lets
them say they can recover ext4 files (even though it also comes
stand alone). I stopped the rm command relatively fast, but it
still got 6 GB out of 846 GB, and I have no idea what is gone or
if it was important. <br>
</p>
<p>The folder I was in was a clone of my home directory as it was
before the system wipe. If it went in alphabetical order, I would
assume it would try to hit all the hidden folders first (unless a
period comes after Zed in the alphabet) and then start to work on
the Desktop and Documents folders, but I don't know how big any of
the hidden files were. I know it didn't get the thunderbird folder
because I was able to restore everything, including my archives,
enigmail, and my pgp key. <br>
</p>
<br>
<div class="moz-cite-prefix">On 02/06/2018 03:07 PM,
<a class="moz-txt-link-abbreviated" href="mailto:nopbin@gmail.com">nopbin@gmail.com</a> via SGVLUG wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CALzJMuT3=zi3VxN7=7FqZ+Z-ps1ydaQwbopLCmf1MucpPu2_xA@mail.gmail.com">
<div dir="auto">
<div>Just a quick note, go for the undelete utilities first, but
when they fail I have had some luck with data carving. Image
the unencrypted partition with dd then use the data carver to
find files of interest with unique signatures.<br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Feb 6, 2018 12:21 PM, "Bryan
Pesterfield via SGVLUG" <<a
href="mailto:sgvlug@sgvlug.net" moz-do-not-send="true">sgvlug@sgvlug.net</a>>
wrote:<br type="attribution">
<blockquote class="quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="auto">Good morning,
<div dir="auto"><br>
</div>
<div dir="auto">I used that dreaded command from the
wrong folder while rebuilding my system and
restoring files. I know I need to be careful with
that command and that sooner or later I would regret
it. That day came yesterday. I was looking at a
different directory and forgot where I was at when I
issued the command.</div>
<div dir="auto"><br>
</div>
<div dir="auto">So far, I have read that debugfs and
lsdel only works on ext2, extundelete works for
unmounted drives but I get a Bad Magic Number error
when attempting to run (presumably because the disk
is encrypted), testdisk says on their wiki it can do
it but gives no indication how, and of course, every
hit on a search engine leaves out one or two terms,
so most of what I find is nonapplicable or junk. </div>
<div dir="auto"><br>
</div>
<div dir="auto">At least when I screw up, I do it
spectacularly. Any ideas? </div>
<div dir="auto"><br>
</div>
<div dir="auto">Thanks, </div>
<font color="#888888">
<div dir="auto">Bryan Pesterfield </div>
</font></div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>