File Recovery tool, KDE

What kind of tools are available through the yast-software menu? What other downloadable tools are available? Any recommendations?

I won’t say what happened as i’m feeling really stupid now. :shame: :wink:

The best way to recover a damaged file, is to restore from the most recent backup.

If you are using “btrfs”, then there may be copies of the files in the snapshots. You can boot from a read-only snapshot and look around. If the files are in your “/home”, then the chances are that you are not using “btrfs” for that.

I am not aware of any file recovery tools with unix file systems other than “btrfs”. A good backup policy is the best protection.

For me, if I badly damaged system files, I would re-install. For “/home” files, I backup from desktop to laptop quite often, and would probably recover that way. I take full backups to an external device less often.

I not use btrfs
The best app for backup of opensuse (root) is running?
I want to a full backup of my root partition on the opensuse which is good software?

May I suggest that you open a thread, perhaps in the “Soapbox” forum, asking for suggestions.

I use “dar”. Some folk use “clonezilla”. Some folk use “rsync”. There are many other options.

But I think my question was related to your thread

nrickert wrote:

>
> The best way to recover a damaged file, is to restore from the most
> recent backup.
>
> If you are using “btrfs”, then there may be copies of the files in the
> snapshots. You can boot from a read-only snapshot and look around. If
> the files are in your “/home”, then the chances are that you are not
> using “btrfs” for that.
>
> I am not aware of any file recovery tools with unix file systems other
> than “btrfs”. A good backup policy is the best protection.
>
> For me, if I badly damaged system files, I would re-install. For
> “/home” files, I backup from desktop to laptop quite often, and would
> probably recover that way. I take full backups to an external device
> less often.
>

There was/is? a group working from, AIR, yahoo groups building a program
called extundelete (or something very similar) for recovering deleted or
other wise “lost” files. Open source, code available so I watched it for a
while and it seemed to be doing a good job.

Ah! There it is. Do a google search on “extundelete” to read a bit about it
plus where to find it. A` quick scan of the search results reminded me that
it was originally for ext3/4 file systems only but I do remember they were
looking at other file systems a year or so back.

I have used photorec in the past with great success.

If you find yourself needing to recover a “permanently” deleted file…

  1. MOST IMPORTANTLY!! - Don’t run your system any more than necessary, or at all. Weigh whether you will want to simply pull the power plug or shut down normally (which will write to disk, or leave the machine running (to avoid writes to disk during a shutdown). Once you “permanently” delete a file, the disk blocks are automatically marked for eventual re-use… Depending on things like whether your disk is a HDD or SSD, how fully used the partition is and how much activity is on that partition will determine how soon your deleted file might be over-written, which at that point severely decreases your chance for recovery.

  2. Of course, the most ideal file recovery is if you have something pre-installed that automatically tracks file changes and enables recovery. BTRFS supports its own snapshots. If you’re running EXT4, I highly recommend extundelete
    http://extundelete.sourceforge.net/

But, of course few people think ahead, so file recovery often becomes an emergency issue after the file has been deleted.

  1. To recover files on any file system (even Windows file systems) no matter whether the file has already been deleted, I highly recommend photorec. Of course, it’s better to have it installed beforehand, but it uniquely enables you to forensically recover deleted files even when it’s installed after the file deletion. Note that you won’t be able to easily identify the file exactly, it won’t be identifiable by its original file name, you’ll have to guess and recover the inodes (recommend the option to recover to a new location to avoid possible over-writes). Personally, I use the date/time property to identify the inode last modified approximately the time the file was deleted.

Good Luck,
TSU

It does not help if it is related. It is a different question and as such needs a different thread with a different title. Understand that many people only browse the titles of threads (and only do so in the sub-forums where they think they can help) and thus your question will never draw the attention of those people.

FYI, I was about to setup a linux backup, like did for mswin, but stalled it too long. (all the mswin files were backed up, unlike linux, head banging on wall). The linux os is gone, overwriten by mswin install dvd. I won’t say any more, see note. There are very few files I really need, one I have to rebuild. The last lost file will a long time to rebuild from last backup.

However, the linux files might still be there. I had mswin - linux file recovery tools, attempt recovery from mswin (different drive). I found a program on source forge. “redobackup-livecd-1.0.4.iso”

I can reinstall linux and use installed recovery tools. If I do I take the risk, I could make it worse. So, I’m going to try the redo iso first. I also have gparted.

Is http://extundelete.sourceforge.net/ make and install?

photorec is a linux utility?

extundelete cannot recover files if you don’t have it installed and running <before> your accidental delete.

photorec is in the OSS and can be used to recover files even if it wasn’t installed before the accidental delete.

Install it simply with the following (should be available in all openSUSE versions). If you install it on the same partition you’re recovering, there is a tiny chance you will over-write the files you want to recover, so beware. It’s convenient to install into the same running system, but it can be destructive (to the file you want to recover). Run from a LiveCD or alternate running system to be fully safe. Yes, if necessary you can recover an entire partition’s worth of files, either to their original locations or to a new location (like another hard drive).

zypper in photorec

TSU

There’s a possibility that the Windows install simply deleted a partition, to make room in the partition table for its own partition, but left the disk space (where that partition was) unaltered.

You have not provided enough information to be able to guess whether this is the case. But perhaps it is a possibility that you could look into.

Bios: UEFI boot set to ‘UEFI + legacy’

Windows kept giving an error whenever I tried to install to SATA2 (can’t format partition, error #80070057), but install to SATA1 worked fine. It took three days to get mswin10 to install and boot to SATA2. It needed some msdos dos commands, but that took entering it 8 times and booting over and over! Geez! :stuck_out_tongue: Did mention all the spy settings in win10, hidden and visible? Linux, not a one problem with installing to either SATA port or no long user legal agreements for every program. Thank you linux developers, my thanks include include my script shortcut for clamscan. :slight_smile:

FYI, I have SATA1(Magnetic) and SATA2(SSD) power switches, custom hardware mod for security reasons. MSWIN installed with SATA2 power on and SATA1 power off. Motherboard boot settings will reset to SATA1–>SATA2 boot order on any switch change.

SATA1(MAG): power on
SATA2(SSD): power on

SATA1: on
SATA2: on

boot to grub menu

SATA1: off
SATA2: on

Boot directly to windows.

If I install ‘opensuse leap 42.1’ to SATA1, grub should set up for a dual boot for two drives. The GRUB boot loader is on SATA1. The boot code on SATA2 is unchanged? What about UEFI boot for mswin?

  1. Both OS must boot in the same boot mode either EFI or legacy/MBR or they can not chain.

  2. openSUSE must be able to see the other OS at install ie either both boot using same method and both disks are on. Or the Windows will not show on the grub menu.

  3. to add to grub you must run Yast bootloader a with probe for foreign OS checked with the Windows drive ON.

  4. Windows must have fast boot OFF

Grab a live image of Kali and use sleuthkit or other file carving programs available.

Thanks, I’v have turned off sleep and fast boot before. I know the procedure.

It said to leave the drive unmounted to avoid any more disk writes. So, installed opensuse leap 42.1 to a large flash drive. It took all day to install and the boot was successful. I tried to install ‘exundelete’ and ‘config.log’ shows this. Do need to add the ‘sources’ in yast-repo?

This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.

It was created by extundelete configure 0.2.4, which was
generated by GNU Autoconf 2.68.  Invocation command line was

  $ ./configure 

## --------- ##
## Platform. ##
## --------- ##

hostname = linux-s6yc
uname -m = x86_64
uname -r = 4.1.20-11-default
uname -s = Linux
uname -v = #1 SMP PREEMPT Fri Mar 18 14:42:07 UTC 2016 (0a392b2)

/usr/bin/uname -p = x86_64
/bin/uname -X     = unknown

/bin/arch              = x86_64
/usr/bin/arch -k       = unknown
/usr/convex/getsysinfo = unknown
/usr/bin/hostinfo      = unknown
/bin/machine           = unknown
/usr/bin/oslevel       = unknown
/bin/universe          = unknown

PATH: /home/username/bin
PATH: /usr/local/bin
PATH: /usr/bin
PATH: /sbin
PATH: /usr/sbin
PATH: /bin
PATH: /usr/bin/X11
PATH: /usr/games


## ----------- ##
## Core tests. ##
## ----------- ##

configure:2133: loading site script /usr/share/site/x86_64-unknown-linux-gnu
| #!/bin/sh
| # Site script for configure. It is resourced via $CONFIG_SITE environment varaible.
| 
| # If user did not specify libdir, guess the correct target:
| # Use lib64 for 64 bit bi-arch targets, keep the default for the rest.
| if test "$libdir" = '${exec_prefix}/lib' ; then
| 
|     ac_config_site_64bit_host=NONE
| 
|     case "$host" in
|     "" )
|         # User did not specify host target.
|         # The native platform x86_64 is a bi-arch platform.
|         # Try to detect cross-compilation to inferior architecture.
| 
|         # We are trying to guess 32-bit target compilation. It's not as easy as
|         # it sounds, as there is possible several intermediate combinations.
|         ac_config_site_cross_to_32bit_host=NONE
| 
|         # User defined -m32 in CFLAGS or CXXFLAGS or CC or CXX:
|         # (It's sufficient for 32-bit, but alone may cause mis-behavior of some checks.)
|         case "$CFLAGS $CXXFLAGS $CC $CXX" in
|         *-m32*)
|             ac_config_site_cross_to_32bit_host=YES
|             ;;
|         esac
| 
|         # Running with linux32:
|         # (Changes detected platform, but not the toolchain target.)
|         case "`/bin/uname -i`" in
|         x86_64 | ppc64 | s390x )
|             ;;
|         * )
|             ac_config_site_cross_to_32bit_host=YES
|             ;;
|         esac
| 
|         if test "x$ac_config_site_cross_to_32bit_host" = xNONE; then
|             ac_config_site_64bit_host=YES
|         fi
| 
|         ;;
|     *x86_64* | *ppc64* | *s390x* )
|         ac_config_site_64bit_host=YES
|         ;;
|     esac
| 
|     if test "x$ac_config_site_64bit_host" = xYES; then
|         libdir='${exec_prefix}/lib64'
|     fi
| fi
| 
| # If user did not specify libexecdir, set the correct target:
| # Nor FHS nor openSUSE allow prefix/libexec. Let's default to prefix/lib.
| 
| if test "$libexecdir" = '${exec_prefix}/libexec' ; then
|     libexecdir='${exec_prefix}/lib'
| fi
| 
| # Continue with the standard behavior of configure defined in AC_SITE_LOAD:
| if test "x$prefix" != xNONE; then
|     ac_site_file1=$prefix/share/config.site
|     ac_site_file2=$prefix/etc/config.site
| else
|     ac_site_file1=$ac_default_prefix/share/config.site
|     ac_site_file2=$ac_default_prefix/etc/config.site
| fi
| for ac_site_file in "$ac_site_file1" "$ac_site_file2"
| do
|     test "x$ac_site_file" = xNONE && continue
|     if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then
|         { $as_echo "/usr/share/site/x86_64-unknown-linux-gnu:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5
| $as_echo "/usr/share/site/x86_64-unknown-linux-gnu: loading site script $ac_site_file" >&6;}
|         sed 's/^/| /' "$ac_site_file" >&5
|         . "$ac_site_file" \
|             || { { $as_echo "/usr/share/site/x86_64-unknown-linux-gnu:${as_lineno-$LINENO}: error: in \`$ac_pwd':" &gt;&5
| $as_echo "/usr/share/site/x86_64-unknown-linux-gnu: error: in \`$ac_pwd':" >&2;}
| as_fn_error $? "failed to load site script $ac_site_file
| See \`config.log' for more details" "$LINENO" 5; }
|     fi
| done
configure:2275: checking for a BSD-compatible install
configure:2343: result: /usr/bin/install -c
configure:2354: checking whether build environment is sane
configure:2404: result: yes
configure:2545: checking for a thread-safe mkdir -p
configure:2584: result: /usr/bin/mkdir -p
configure:2597: checking for gawk
configure:2613: found /usr/bin/gawk
configure:2624: result: gawk
configure:2635: checking whether make sets $(MAKE)
configure:2657: result: yes
configure:2802: checking for g++
configure:2832: result: no
configure:2802: checking for c++
configure:2832: result: no
configure:2802: checking for gpp
configure:2832: result: no
configure:2802: checking for aCC
configure:2832: result: no
configure:2802: checking for CC
configure:2832: result: no
configure:2802: checking for cxx
configure:2832: result: no
configure:2802: checking for cc++
configure:2832: result: no
configure:2802: checking for cl.exe
configure:2832: result: no
configure:2802: checking for FCC
configure:2832: result: no
configure:2802: checking for KCC
configure:2832: result: no
configure:2802: checking for RCC
configure:2832: result: no
configure:2802: checking for xlC_r
configure:2832: result: no
configure:2802: checking for xlC
configure:2832: result: no
configure:2856: checking for C++ compiler version
configure:2865: g++ --version &gt;&5
./configure: line 2867: g++: command not found
configure:2876: $? = 127
configure:2865: g++ -v &gt;&5
./configure: line 2867: g++: command not found
configure:2876: $? = 127
configure:2865: g++ -V &gt;&5
./configure: line 2867: g++: command not found
configure:2876: $? = 127
configure:2865: g++ -qversion &gt;&5
./configure: line 2867: g++: command not found
configure:2876: $? = 127
configure:2896: checking whether the C++ compiler works
configure:2918: g++    conftest.cpp  &gt;&5
./configure: line 2920: g++: command not found
configure:2922: $? = 127
configure:2960: result: no
configure: failed program was:
| /* confdefs.h */
| #define PACKAGE_NAME "extundelete"
| #define PACKAGE_TARNAME "extundelete"
| #define PACKAGE_VERSION "0.2.4"
| #define PACKAGE_STRING "extundelete 0.2.4"
| #define PACKAGE_BUGREPORT "extundelete.sourceforge.net"
| #define PACKAGE_URL ""
| #define PACKAGE "extundelete"
| #define VERSION "0.2.4"
| /* end confdefs.h.  */
| 
| int
| main ()
| {
| 
|   ;
|   return 0;
| }
configure:2965: error: in `/home/username/bin/extundelete-0.2.4':
configure:2967: error: C++ compiler cannot create executables
See `config.log' for more details

## ---------------- ##
## Cache variables. ##
## ---------------- ##

ac_cv_env_CCC_set=
ac_cv_env_CCC_value=
ac_cv_env_CC_set=
ac_cv_env_CC_value=
ac_cv_env_CFLAGS_set=
ac_cv_env_CFLAGS_value=
ac_cv_env_CPPFLAGS_set=
ac_cv_env_CPPFLAGS_value=
ac_cv_env_CPP_set=
ac_cv_env_CPP_value=
ac_cv_env_CXXFLAGS_set=
ac_cv_env_CXXFLAGS_value=
ac_cv_env_CXX_set=
ac_cv_env_CXX_value=
ac_cv_env_LDFLAGS_set=
ac_cv_env_LDFLAGS_value=
ac_cv_env_LIBS_set=
ac_cv_env_LIBS_value=
ac_cv_env_build_alias_set=
ac_cv_env_build_alias_value=
ac_cv_env_host_alias_set=
ac_cv_env_host_alias_value=
ac_cv_env_target_alias_set=
ac_cv_env_target_alias_value=
ac_cv_path_install='/usr/bin/install -c'
ac_cv_path_mkdir=/usr/bin/mkdir
ac_cv_prog_AWK=gawk
ac_cv_prog_make_make_set=yes

## ----------------- ##
## Output variables. ##
## ----------------- ##

ACLOCAL='${SHELL} /home/username/bin/extundelete-0.2.4/missing --run aclocal-1.11'
AMDEPBACKSLASH=''
AMDEP_FALSE=''
AMDEP_TRUE=''
AMTAR='$${TAR-tar}'
AUTOCONF='${SHELL} /home/username/bin/extundelete-0.2.4/missing --run autoconf'
AUTOHEADER='${SHELL} /home/username/bin/extundelete-0.2.4/missing --run autoheader'
AUTOMAKE='${SHELL} /home/username/bin/extundelete-0.2.4/missing --run automake-1.11'
AWK='gawk'
CC=''
CCDEPMODE=''
CFLAGS=''
CPP=''
CPPFLAGS=''
CXX='g++'
CXXDEPMODE=''
CXXFLAGS=''
CYGPATH_W='echo'
DEFS=''
DEPDIR=''
ECHO_C=''
ECHO_N='-n'
ECHO_T=''
EGREP=''
EU_CFLAGS=''
EU_CXXFLAGS=''
EU_OPTFLAGS=''
EU_OPTXXFLAGS=''
EU_SCFLAGS=''
EU_SCXXFLAGS=''
EU_WCFLAGS=''
EU_WCXXFLAGS=''
EXEEXT=''
GREP=''
INSTALL_DATA='${INSTALL} -m 644'
INSTALL_PROGRAM='${INSTALL}'
INSTALL_SCRIPT='${INSTALL}'
INSTALL_STRIP_PROGRAM='$(install_sh) -c -s'
LDFLAGS=''
LIBOBJS=''
LIBS=''
LTLIBOBJS=''
MAKEINFO='${SHELL} /home/username/bin/extundelete-0.2.4/missing --run makeinfo'
MKDIR_P='/usr/bin/mkdir -p'
OBJEXT=''
PACKAGE='extundelete'
PACKAGE_BUGREPORT='extundelete.sourceforge.net'
PACKAGE_NAME='extundelete'
PACKAGE_STRING='extundelete 0.2.4'
PACKAGE_TARNAME='extundelete'
PACKAGE_URL=''
PACKAGE_VERSION='0.2.4'
PATH_SEPARATOR=':'
SET_MAKE=''
SHELL='/bin/sh'
STRIP=''
VERSION='0.2.4'
ac_ct_CC=''
ac_ct_CXX=''
am__EXEEXT_FALSE=''
am__EXEEXT_TRUE=''
am__fastdepCC_FALSE=''
am__fastdepCC_TRUE=''
am__fastdepCXX_FALSE=''
am__fastdepCXX_TRUE=''
am__include=''
am__isrc=''
am__leading_dot='.'
am__nodep=''
am__quote=''
am__tar='$${TAR-tar} chof - "$$tardir"'
am__untar='$${TAR-tar} xf -'
bindir='${exec_prefix}/bin'
build_alias=''
datadir='${datarootdir}'
datarootdir='${prefix}/share'
docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
dvidir='${docdir}'
exec_prefix='NONE'
host_alias=''
htmldir='${docdir}'
includedir='${prefix}/include'
infodir='${datarootdir}/info'
install_sh='${SHELL} /home/username/bin/extundelete-0.2.4/install-sh'
libdir='${exec_prefix}/lib64'
libexecdir='${exec_prefix}/lib'
localedir='${datarootdir}/locale'
localstatedir='${prefix}/var'
mandir='${datarootdir}/man'
mkdir_p='/usr/bin/mkdir -p'
oldincludedir='/usr/include'
pdfdir='${docdir}'
prefix='NONE'
program_transform_name='s,x,x,'
psdir='${docdir}'
sbindir='${exec_prefix}/sbin'
sharedstatedir='${prefix}/com'
sysconfdir='${prefix}/etc'
target_alias=''

## ----------- ##
## confdefs.h. ##
## ----------- ##

/* confdefs.h */
#define PACKAGE_NAME "extundelete"
#define PACKAGE_TARNAME "extundelete"
#define PACKAGE_VERSION "0.2.4"
#define PACKAGE_STRING "extundelete 0.2.4"
#define PACKAGE_BUGREPORT "extundelete.sourceforge.net"
#define PACKAGE_URL ""
#define PACKAGE "extundelete"
#define VERSION "0.2.4"

configure: exit 77

Are you sure that extundelete is what you need?

I repeat from my earlier post,
extundelete will not recover files unless it was <already> installed and running before your accidental file deletion.

If you’re trying to recover <after> a file deletion and didn’t have a file recovery tool installed <before> your accident, then you need to be running photorec.

TSU

Something else to consider…
If your partitions were damaged or removed but the data is still intact, untouched and still valid,
If you kept good records and know <exactly> your partition boundaries,
You can reset those partition boundaries and your data will magically all be accessible like before.
This happened to me on a system many years ago, and to my surprise (and thankfulness), that was how I fixed the system.

Note that you need to really understand what has happened to your system for this to work.

TSU

Run from a LiveCD

I have gparted, System rescue CD, and KDE LIVE.

Are you sure that extundelete is what you need?

Also, I’v read about the other methods. I want to try exundelete first. If that doesn’t work, i’ll try them.

If I install ‘opensuse 42.1 leap’ dvd, I run the risk of overwriting the files. Booting from separate flash drive (boot flashdrive ‘opensuse 42.1 leap’) then installing exundelete into it is the safer bet.

I repeat from my earlier post,
extundelete will not recover files unless it was <already> installed and running before your accidental file deletion.

Something else to consider…
If your partitions were damaged or removed but the data is still intact, untouched and still valid,
If you kept good records and know <exactly> your partition boundaries,
You can reset those partition boundaries and your data will magically all be accessible like before.
This happened to me on a system many years ago, and to my surprise (and thankfulness), that was how I fixed the system.

Note that you need to really understand what has happened to your system for this to work.

This is a detailed step by step of what happened and current steps. This should clear it up.


‘opensuse leap 42.1’ linux drive overwritten by full mswin dvd install to final boot (SATA1).

SATA1(MAG): ‘opensuse leap 42.1’ full install. –> mswin dvd full install to final reboot. Note: Nothing more installed. Chance of finding lost linux directories.
SATA2(SSD): mswin dvd full install to final reboot. (completed)

SATA1: power on
SATA2: power off

Flash drive (large): installed opensuse linux 42.1 full dvd (username, passwords, etc. A working a fully bootable Linux) –> boot –> boot menu –> select flash drive). linux flash drive boot complete –> SATA1 partitions not mounted (or unmounted quickly).

Documentation

How to compile and install extundelete

To compile and install this program, you must first install the binary and development packages for e2fsprogs (called libext2fs-devel on Mageia, or e2fslibs-dev on Ubuntu, or e2fsprogs-devel on Fedora). extundelete requires libext2fs version 1.39 or newer to run, but for ext4 support, ensure you have e2fsprogs version 1.41 or newer (which may be found by running the command ‘dumpe2fs’ and noting the version it outputs). You must have g++ and GNU make to compile the program. You can install those with the package called build-essential on Ubuntu, or gcc-c++ and make on Fedora, or gcc-c++ and make on Mageia.
To compile the program, simply enter the command “./configure” from the directory the tar.bz2 file was extracted to. The configure step ensures all the necessary programs to install and run extundelete have been installed. Then, run “make” from the same directory to compile the program. The command will generate an executable file called “extundelete” in the “src” directory. You can the run “make install” to install the program in the /usr/bin directory, or it could be run from the “src” directory without this step.
How to use extundelete

extundelete is designed to undelete files from an unmounted partition to a separate (mounted) partition. extundelete will restore any files it finds to a subdirectory of the current directory named “RECOVERED_FILES”. To run the program, type “extundelete --help” to see various options available to you.
Typical usage to restore all deleted files from a partition looks like this:
$ extundelete /dev/sda4 --restore-all
For an example of running the program, see the file “README” included with the program. It is normal for extundelete to appear to pause (while taking up a lot of cpu cycles) for a minute or longer; during this time, the program is reading the directory structure and looking for a recoverable file within it. To restore important files quickly, you may use the --restore-file, --restore-files, or --restore-directory options.
If you have questions or comments about using exundelete or how to recover your lost files, or to report a success/failure of your recovery efforts with this utility, send a note to the extundelete mailing list.

Flash drive boot –> unzip and copy unundelete folder to 'home/user/bin/exundelete –> open folder 'home/user/bin/exundelete –> enter superuser command prompt –> .configure


read ‘config.log’. Yast->repo-> add sources repo? What is needed?

I need to get the home folder (recursive search down) only off the unmounted partition. It should be this command:

blkid -o list

find SATA1 partition, dir paths is a sample for reference here so I can understand the formatting

(sample)

extundelete /dev/sda4  --restore-directory /dev/sda4/home/username/

extundelete works like BTRFS snapshots…
If it’s not running beforehand to track the file system changes, it’s not going to <find> anything without first tracking those changes.
In the same way, if you turn off BTRFS snapshots, you’re not going to be able to recover anything.

photorec on the other hand does not “find” files, it reads the disks inodes which you can think of as a higher level disk data management system that always exists so nothing is dependent on the application running (ie you can use any app that can read inodes, and there are forensic data recovery tools that do just that. You don’t have to use a higher level app like photorec speciically).

If you have access to another running machine, I highly recommend you install and run both these apps to understand how they work. After installing, you can try both recovering a file which was “permanently” deleted before installing and recover a file deleted after installing. It should take only about 15 minutes or so to verify what I’ve described.

TSU

If you have access to another running machine, I highly recommend you install and run both these apps to understand how they work. After installing, you can try both recovering a file which was “permanently” deleted before installing and recover a file deleted after installing. It should take only about 15 minutes or so to verify what I’ve described.

Bootable flashdrive where I’m installing exundelete to.

tsu2 extundelete works like BTRFS snapshots…
If it’s not running beforehand to track the file system changes, it’s not going to <find> anything without first tracking those changes.
In the same way, if you turn off BTRFS snapshots, you’re not going to be able to recover anything.

Exundelete partition recovery: $ extundelete /dev/sda4 --restore-all (installed to linux flash drive)

I don’t think I turned off snapsnots. All the linux partitions are deleted and replaced with mswin partitions. I need to search the partitions for any linux file data. Once, I get the compile to work.

photorec on the other hand does not “find” files, it reads the disks inodes which you can think of as a higher level disk data management system that always exists so nothing is dependent on the application running (ie you can use any app that can read inodes, and there are forensic data recovery tools that do just that. You don’t have to use a higher level app like photorec specifically).

photorec: zypper in photorec

I can try that as well.