# PANIC - Undeleting file from EXT4

## Holysword

So yeah... I spend a few days trying to record something... it took me several attempts to get it right and then when I use mencoder to downsample and compress it, *pooof* things crash, original video disappears and a small part of the downsampled video is still there to tell the story.

Trying to put the rage aside, I am trying to undelete the file. I booted from SystemRescueCD, the filesystem containing it isunmounted. I know the path (of course) but the file was replaced many, many times; every attempt I restarted recording it again with the same name, overriding the file. The file is very large, a little more than 30GB. extundelete is being unable to find the file:

```
root@sysresccd /root % extundelete --restore-file /home/holysword/SpiderOak\ Hive/itf.mkv /dev/sda3

NOTICE: Extended attributes are not restored.

Loading filesystem metadata ... 2400 groups loaded.

Loading journal descriptors ... 30875 descriptors loaded.

Unable to restore inode 7745731 (home/holysword/SpiderOak Hive/itf.mkv): No data found.

Unable to restore file /home/holysword/SpiderOak Hive/itf.mkv

extundelete: Operation not permitted while restoring file.

extundelete: Operation not permitted when trying to examine filesystem

root@sysresccd /root %
```

This is the path from the root of the partition; should I mount it? Am I using this correctly?

I am running also photorec software, but I am a bit afraid that I will run out of disk space, since it copies the files from /dev/sda3 to another partition. Please, suggestions? I need this REALLY SOON or I will be doomed! Tomorrow I will NEED TO mount this partition and use it normally!

----------

## windex

Usually I'd use a tool called foremost for something like this, although it's conceivable that foremost may not have a signature for this sort of file.  

What file type (extension?) was the deleted file?  In theory you could develop a signature if you really had to.  

Foremost is actually pretty good.

----------

## Holysword

 *windex wrote:*   

> Usually I'd use a tool called foremost for something like this, although it's conceivable that foremost may not have a signature for this sort of file.  
> 
> What file type (extension?) was the deleted file?  In theory you could develop a signature if you really had to.  
> 
> Foremost is actually pretty good.

 

Thank you for your suggestion, but it was really too late! I needed the answer really quick and then the file was lost forever. I will keep in mind your suggestion for next time though.

The file was .mkv

----------

