Member Avatar for lewashby

I recently compressed a whole username(I think the file was DeveloperBackup and I think the extention was .gz but I'M not certain) in ubuntu and I had one copy of the file on my ubuntu laptop and one on my external HD. I know this sounds really stupid of me and it is, but I accidently deleted both copies. I'M pretty sure the copy on the laptop can not be recovered since I just overwrote it with Windows. The one on the external HD was deleted while pluged into my Windows desktop. So I can the program testdisk - photorec_win.exe and seleced the external HD as my tarted. It has retrieved a mountain of files but I have yet to get the file DevloperBackup.gz or anything clole to. This stupid removal was very recent. Any ideas or suggestions? Also, when removing files from an external HD, should I be looking there for retrival or from the desktop that gave the DELETE command? Thanks for any and all replies.

  • 2 Contributors
  • 1 Reply
  • 140 Views
  • 1 Hour Discussion Span
  • Latest Post Latest Post by caperjack

Dani AI

Generated

Short answer for : focus recovery efforts on the physical device that actually held the deleted archive. The delete command only removes the directory entry on the volume where the file lived; the file data usually remains on that same volume until overwritten. Good point by to check both places, but priority is to stop any writes to the external device and work from a forensic image of that device.

Immediate practical steps:

  • Stop using the external disk and do not copy recovered files back to it.
  • Create a sector-by-sector image of the external disk and work from the image (not the original). On Linux a safe way is GNU ddrescue; example:
ddrescue -n /dev/sdX /path/to/external.img /path/to/ddrescue.log

Run a non-destructive first pass (-n), then do retries (-r) only if needed. On Windows, use a read-only imager (for example, FTK Imager) to produce an image.

How to target a gzip archive: gzip uses the magic bytes 0x1F 0x8B 0x08 (see the gzip spec). File-carving tools can scan the image for that header and extract candidates. Example with a carving tool:

foremost -t gz -i /path/to/external.img -o /path/to/recovery_output

Carved files will often lose original filenames and folder structure. Validate candidates with file or gzip -t and inspect contents after extraction.

If carving fails, possible causes include fragmentation or metadata loss. For NTFS, MFT-based recovery tools can sometimes restore filenames and contiguous files; for ext filesystems there are dedicated undelete tools. If the archive is critical and these steps do not locate a valid .gz, consider professional recovery—every further write reduces success chances.

References: GNU ddrescue, , GZIP file format (RFC 1952).

Member Avatar for caperjack

search both drivers ,even the one you recently installed window on ,i have use Free Recuva program with success in the past .
http://www.piriform.com/recuva/download

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.