[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: extcarve - ext2,ext3,ext4 file carving tool



On Tue, Jun 14, 2011 at 2:11 AM, Lakshmipathi.G
<lakshmipathi g gmail com> wrote:
>
>>
>> What are the pros and cons when compared to ext3grep and extundelete?
>>
> Carlo wood's ext3grep uses Journal entries to recover the files. If I'm not
> wrong extundelete ,is an extension of ext3grep which supports ext4.
> If Journal entries are lost or overwritten,It would be difficult for them to
> recover. (Please correct me,If I'm wrong :D )
>
> extcarve doesn't depend on journal entries - It scans the disk for valid
> magic signature of a file and tries to recover them.
> I think extcarve  similar to tool like foremost
> http://foremost.sourceforge.net/
>
>
Good, I tested these three tools on one of my disk, which I deleted
many files last week, the results shows:

ext3grep can list what I deleted, but cannot recover
extundelete can recover part of my files
extcarve, fails to recover any of my files, it is keeping print
messages like this:

no header found.at all
Searching Unused block 415494 which contains non-zero data:

no header found.at all
Searching Unused block 415495 which contains non-zero data:

no header found.at all
Searching Unused block 415496 which contains non-zero data:

no header found.at all
Searching Unused block 415497 which contains non-zero data:

no header found.at all
Searching Unused block 415498 which contains non-zero data:

no header found.at all
Searching Unused block 415499 which contains non-zero data:

no header found.at all
Searching Unused block 415500 which contains non-zero data:

no header found.at all
Searching Unused block 415501 which contains non-zero data:

no header found.at all
Searching Unused block 415502 which contains non-zero data:

no header found.at all
Searching Unused block 415503 which contains non-zero data:

no header found.at all
Searching Unused block 415504 which contains non-zero data:

no header found.at all
Searching Unused block 415505 which contains non-zero data:

no header found.at all
Searching Unused block 415506 which contains non-zero data:

no header found.at all
Searching Unused block 415507 which contains non-zero data:

no header found.at all
Searching Unused block 415508 which contains non-zero data:

no header found.at all
Searching Unused block 415509 which contains non-zero data:

I saw almost a million of such lines.

>>
>> In addition, what is the Pen drive? I mean, since we need to attach an
>> external harddrive, why don't we run the command within the harddrive?
>>
>
> I was just extra-careful, I have seen some new users installs the recover
> software on the affected partition itself,which is not a good thing (The
> recover software may overwrite the file,user wants to recover) .Yes,you can
> install the command on external hard-drive and use it.
>
>
Okay, I see, thank you.

Jidong


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]