Re: Need help undeleting a Big gz compressed tar ball

2013-06-16 Thread Chris Bannister
On Sat, Jun 15, 2013 at 01:14:47PM -0400, To Ro wrote: I started testing one of the recovered files, with a binary file editor can se a long sequence of zeros at the very beginning of it, took some precautions, and here is what I see ls -lh total 5.8G -r 1 xyz xyz 5.8G Jun 14 17:52

Re: Need help undeleting a Big gz compressed tar ball

2013-06-16 Thread Ralf Mardorf
On Sun, 2013-06-16 at 22:34 +1200, Chris Bannister wrote: On Sat, Jun 15, 2013 at 01:14:47PM -0400, To Ro wrote: I started testing one of the recovered files, with a binary file editor can se a long sequence of zeros at the very beginning of it, took some precautions, and here is what I see

Re: Need help undeleting a Big gz compressed tar ball

2013-06-16 Thread Ralf Mardorf
PS: If the OP does remember the date, it might help to recover files only from this date or at least recover only files from a given time span, most, if not all tools provide this option too. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe.

Re: Need help undeleting a Big gz compressed tar ball

2013-06-15 Thread To Ro
On Fri, Jun 14, 2013 at 1:13 PM, green greenfreedo...@gmail.com wrote: To Ro wrote at 2013-06-14 06:02 -0500: At this point I have to wait about two weeks before I can afford getting a 2TB drive where I could dump the recovered parts and try to resuscitate it. Is there any site that would

Re: Need help undeleting a Big gz compressed tar ball

2013-06-15 Thread green
To Ro wrote at 2013-06-15 12:14 -0500: I started testing one of the recovered files, with a binary file editor can se a long sequence of zeros at the very beginning of it, took some precautions, and here is what I see ls -lh total 5.8G -r 1 xyz xyz 5.8G Jun 14 17:52 inode_17000

Re: Need help undeleting a Big gz compressed tar ball

2013-06-14 Thread To Ro
On Thu, Jun 13, 2013 at 10:53 PM, green greenfreedo...@gmail.com wrote: Bob Proulx wrote at 2013-06-13 11:45 -0500: Good to hear that it was not ext3! For ext3, there is the ext4magic tool. (I have not used it.) Thank you guys for all your input. The mention of scalpel, scrounge-ntfs

Re: Need help undeleting a Big gz compressed tar ball

2013-06-14 Thread green
To Ro wrote at 2013-06-14 06:02 -0500: At this point I have to wait about two weeks before I can afford getting a 2TB drive where I could dump the recovered parts and try to resuscitate it. Is there any site that would have information about forensics? The best way to prepare is by learning

Re: Need help undeleting a Big gz compressed tar ball

2013-06-13 Thread To Ro
Thank you Bob. The Seagate drive has NTFS, I never reformatted it. There is where the big tar file was. Here is another question: How does the creation of a tar.gz ball occur? Is it a) first compressing files and directories and then taring them or b) taring and then compressing? If the

Re: Need help undeleting a Big gz compressed tar ball

2013-06-13 Thread Linux-Fan
On 06/13/2013 11:29 AM, To Ro wrote: Thank you Bob. The Seagate drive has NTFS, I never reformatted it. There is where the big tar file was. Here is another question: How does the creation of a tar.gz ball occur? Is it a) first compressing files and directories and then taring them or b)

Re: Need help undeleting a Big gz compressed tar ball

2013-06-13 Thread green
To Ro wrote at 2013-06-12 14:44 -0500: Where: External SeaGate Drive of 1 TB I had a Big.tar.gz file (about 400gb) with all the contents of my home directory, in a maze of directories and subdirectories. After extracting a directory with all its contents from Big.tar.gz to my hard drive, I

Re: Need help undeleting a Big gz compressed tar ball

2013-06-13 Thread Bob Proulx
To Ro wrote: Here is another question: How does the creation of a tar.gz ball occur? Is it That is one of those questions like Bilbo's riddle. It is created by the commands that created it and there isn't any other way to know. Except that you said it was 400G and that means almost certainly

Re: Need help undeleting a Big gz compressed tar ball

2013-06-13 Thread green
Bob Proulx wrote at 2013-06-13 11:45 -0500: Good to hear that it was not ext3! For ext3, there is the ext4magic tool. (I have not used it.) signature.asc Description: Digital signature

Need help undeleting a Big gz compressed tar ball

2013-06-12 Thread To Ro
Where: External SeaGate Drive of 1 TB I had a Big.tar.gz file (about 400gb) with all the contents of my home directory, in a maze of directories and subdirectories. After extracting a directory with all its contents from Big.tar.gz to my hard drive, I decided to delete that particular directory.

Re: Need help undeleting a Big gz compressed tar ball

2013-06-12 Thread Bob Proulx
To Ro wrote: After a few hours, my Big.tar.gz was gone. I tried testdisk, but has not been very succesful. I was able to see and copy to another disk about 18 files of different sizes, from 6 gb to 70 gb, with names such as inode_x Running the command file inode_x yields not much, it