I accidentally deleted a zstd compressed image of a drive that I backed up. That drive has been put to use elsewhere, so is little chance I can recover the original partitions from it.

I immediately unmounted the backup drive I had the image stored on and it has not been written to since. It contains an LVM physical partition with a single LUKS encrypted ext4 volume.

I’ve tried using photorec on the ext4 volume, but it seems to be recognizing files that were inside the compressed image, and not the image itself. Text files that are “recovered” contain many invalid characters, and other filetypes are unusable.

While I could cut my losses now and move on without that backup image, I would prefer if I could recover it and the data inside. I’ve looked elsewhere across the internet, and haven’t found any useful information regarding whether this is possible or not.

  • sylver_dragon@lemmy.world
    link
    fedilink
    English
    arrow-up
    4
    ·
    3 days ago

    You could try using Autopsy to look for files on the drive. Autopsy is a forensic analysis toolkit, which is normally used to extract evidence from disk images or the like. But, you can add local drives as data sources and that should let you browse the slack space of the filesystem for lost files. This video (not mine, just a good enough reference) should help you get started. It’s certainly not as simple as the photorec method, but it tends to be more comprehensive.