I'm trying to recover from an accidental format of ext4 1TB HDD. I tried virtually all Linux tools (extundelete, ext3grep, ext4magic, testdisk, photorec, and others).
Some that worked: testdisk, photorec and foremost. They recovered some 300000 files, but they didn't recover the hdd folder structure, which is very important to me because I had many projects and important documents in this HDD.
They just recovered files and put them in folders divided by extension or some in a unique folder.
extundelete couldn't find anything. ext3grep and ext4magic crashed.
I'm trying for more than a week to find a tool that recover folder structure with no luck.
Is this possible ? I mean recover files inside the correct folder structure ?
History
I accidentally formatted it and immediately shut down the computer. It was a data only HDD with no file system files in it. I initially thought I had
a good chance of recovering it, but I'm start to think I'll have to deal with organizing thousands of files.
I have searched many forums, and help sites like this and couldn't find anything that works.
In order to recover from it I bought a Blackarmor NAS with 6TB space, so I have plenty of room to any recovery operation.
All utilities mentioned above, as well as all the recovered files were recovered not from the unit itself, but from an image I've made with dd.
The HDD itself is physically OK. No damaged sectors or malfunctions.
At this point, I'm not getting anywhere, so I sent the physical HDD to a data recovery company.
Any advice about recovering files and folder structure can only be based now on the image I have.
Best Answer
The forensic tools the recovery company will use could include EnCase Forensic, which is probably the leading forensic data recovery utility. EnCase takes the drive image recovers the raw data, then makes pretty intelligent assumptions as to what blocks form what files.
There are still limitations, so an element of this is likely to be manually processed.
On a Windows machine you'd likely have a copy of your Master File Table. Sadly, under ext4 this doesn't exist, but you can make reasonable assumptions based on inode timestamps and other metadata.