Ubuntu-fr

xianbroc

[Résolu] Perte de données sur disque externe

Bonjour,
Suite à une erreur de manipulation j'ai perdu des fichiers, environ 0.5 To, sur un disque externe qui me sert à faire des sauvegardes.
Ce disque "SauvegardeOrdiHP" est de 2Toctets et contient actuellement 0.8 To de données.
Les fichiers perdus sont essentiellement des répertoires contenant des images ou des vidéos.
J'ai acheté un second disque externe, "Elements", de 5 To pour récupérer ces répertoires perdus.
J'ai essayé d’utiliser "foremost", qui est censé donner de bons résultats, par la commande :

$ mkdir /media/xianne/Elements/Recover
$ cd /media/xianne/SauvegardeOrdiHP/
$ sudo foremost ./ -v -q -T  -o /media/xianne/Elements/Recover

Ça a l'air de tourner sans donner de résultat : tous les répertoires de "/media/xianne/Elements/Recover_Wed_Jul_14_14_39_20_2021" restent désespérément vides.
Après un <CTRL>D, on a :

Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Wed Jul 14 14:39:20 2021
Invocation: foremost ./ -v -q -T -o /media/xianne/Elements/Recover 
Output directory: /media/xianne/Elements/Recover_Wed_Jul_14_14_39_20_2021
Configuration file: /etc/foremost.conf
Processing: stdin
|------------------------------------------------------------------
File: stdin
Start: Wed Jul 14 14:39:20 2021
Length: Unknown
 
Num	 Name (bs=512)	       Size	 File Offset	 Comment 

|

0 FILES EXTRACTED
	
------------------------------------------------------------------

Le fichier de conf est :

$ cat /etc/foremost.conf 
#
# Foremost configuration file
#-------------------------------------------------------------------------
# Note the foremost configuration file is provided to support formats which
# don't have built-in extraction functions.  If the format is built-in to foremost
# simply run foremost with -t <suffix> and provide the format you wish to extract. 
#
# The configuration file is used to control what types of files foremost
# searches for. A sample configuration file, foremost.conf, is included with
# this distribution. For each file type, the configuration file describes
# the file's extension, whether the header and footer are case sensitive,
# the maximum file size, and the header and footer for the file. The footer
# field is optional, but header, size, case sensitivity, and extension are
# not!
#
# Any line that begins with a '#' is considered a comment and ignored. Thus,
# to skip a file type just put a '#' at the beginning of that line
#

# Headers and footers are decoded before use. To specify a value in
# hexadecimal use \x[0-f][0-f], and for octal use \[0-3][0-7][0-7].  Spaces
# can be represented by \s. Example: "\x4F\123\I\sCCI" decodes to "OSI CCI".
#
# To match any single character (aka a wildcard) use a '?'. If you need to
# search for the '?' character, you will need to change the 'wildcard' line
# *and* every occurrence of the old wildcard character in the configuration
# file. Don't forget those hex and octal values! '?' is equal to 0x3f and
# \063.
#
# If you would like to extract files without an extension enter the value
# "NONE" in the extension column (note: you can change the value of this
# "no suffix" flag by setting the variable FOREMOST_NOEXTENSION_SUFFIX
# in foremost.h and recompiling).
#
# The ASCII option will extract all ASCII printable characters before and after 
# the keyword provided.
#
# The NEXT keyword after a footer instructs foremost to search forwards for data 
# that starts with the header provided and terminates or is followed by data in 
# the footer -- the footer data is not included in the output.  The data in the 
# footer, when used with the NEXT keyword effectively allows you to search for 
# data that you know for sure should not be in the output file.  This method for 
# example, lets you search for two 'starting' headers in a document that doesn't 
# have a good ending footer and you can't say exactly what the footer is, but 
# you know if you see another header, that should end the search and an output
# file should be written.

# To redefine the wildcard character, change the setting below and all
# occurances in the formost.conf file.
#
#wildcard  ?
#
#		case	size	header			footer
#extension   sensitive	
#
#---------------------------------------------------------------------
# EXAMPLE WITH NO SUFFIX
#---------------------------------------------------------------------
#
# Here is an example of how to use the no extension option. Any files 
# containing the string "FOREMOST" would be extracted to a file without 
# an extension (eg: 00000000,00000001)
#      NONE     y      1000     FOREMOST
#
#---------------------------------------------------------------------
# GRAPHICS FILES
#---------------------------------------------------------------------	
#
#
# AOL ART files
#	art	y	150000	\x4a\x47\x04\x0e	\xcf\xc7\xcb
#  	art	y 	150000	\x4a\x47\x03\x0e	\xd0\xcb\x00\x00
#
# GIF and JPG files (very common)
#	(NOTE THESE FORMATS HAVE BUILTIN EXTRACTION FUNCTION)
#	gif	y	155000000	\x47\x49\x46\x38\x37\x61	\x00\x3b
#  	gif	y 	155000000	\x47\x49\x46\x38\x39\x61	\x00\x00\x3b
  	jpg	y	20000000	\xff\xd8\xff\xe0\x00\x10	\xff\xd9
  	jpg	y	20000000	\xff\xd8\xff\xe1 \xff\xd9 
  	jpg	y	20000000	\xff\xd8	\xff\xd9
#
# PNG   (used in web pages)
#	(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
  	png	y	200000	\x50\x4e\x47?	\xff\xfc\xfd\xfe
#
#
# BMP 	
#	(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
	bmp	y	100000	BM??\x00\x00\x00
#
# TIF
  	tif	y	200000000	\x49\x49\x2a\x00
#
#---------------------------------------------------------------------	
# ANIMATION FILES
#---------------------------------------------------------------------	
#
# AVI (Windows animation and DiVX/MPEG-4 movies)
#	(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
  	avi	y	4000000 RIFF????AVI
#
# Apple Quicktime
#	(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
	mov	y	4000000	????????\x6d\x6f\x6f\x76
	mov	y	4000000	????????\x6d\x64\x61\x74
#
# MP4  Video
	mp4	y	4000000	mp4	eof
#
# MPEG Video
	mpg	y	4000000	mpg	eof
	mpg	y	20000000 \x00\x00\x01\xba      \x00\x00\x01\xb9
	mpg     y 	20000000 \x00\x00\x01\xb3 	\x00\x00\x01\xb7
#
# Macromedia Flash
#	fws	y	4000000	FWS
#
#---------------------------------------------------------------------	
# MICROSOFT OFFICE 
#---------------------------------------------------------------------	
#
# Word documents
#	(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
	doc	y	12500000  \xd0\xcf\x11\xe0\xa1\xb1
#
# Outlook files
#	pst	y	400000000 \x21\x42\x4e\xa5\x6f\xb5\xa6
#	ost	y	400000000 \x21\x42\x44\x4e
#
# Outlook Express
#	dbx	y	4000000	\xcf\xad\x12\xfe\xc5\xfd\x74\x6f
#	idx	y	4000000	\x4a\x4d\x46\x39
#	mbx	y	4000000	\x4a\x4d\x46\x36
#
#---------------------------------------------------------------------	
# WORDPERFECT
#---------------------------------------------------------------------
#
#	wpc	y	100000	?WPC
#
#---------------------------------------------------------------------	
# HTML		(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
#---------------------------------------------------------------------	
#
#	htm	n	50000   <html			</html>
#
#---------------------------------------------------------------------	
# ADOBE PDF	(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
#---------------------------------------------------------------------	
#
	pdf	y	5000000	%PDF-  %EOF 
#
#
#---------------------------------------------------------------------	
# AOL (AMERICA ONLINE)
#---------------------------------------------------------------------	
#
# AOL Mailbox
#	mail	y	500000	 \x41\x4f\x4c\x56\x4d
#
#
#	
#---------------------------------------------------------------------	
# PGP (PRETTY GOOD PRIVACY)
#---------------------------------------------------------------------	
#
# PGP Disk Files
#	pgd	y	500000	\x50\x47\x50\x64\x4d\x41\x49\x4e\x60\x01
#
# Public Key Ring
#	pgp	y	100000	\x99\x00
# Security Ring
#	pgp	y	100000	\x95\x01
#	pgp	y	100000	\x95\x00
# Encrypted Data or ASCII armored keys
#	pgp	y	100000	\xa6\x00
# (there should be a trailer for this...)
	txt	y	100000	-----BEGIN\040PGP
#
#
#---------------------------------------------------------------------	
# RPM (Linux package format)
#---------------------------------------------------------------------	
#	rpm	y	1000000	\xed\xab
#
#
#---------------------------------------------------------------------	
# SOUND FILES
#---------------------------------------------------------------------	
#	(NOTE THIS FORMAT HAS A BUILTIN EXTRACTION FUNCTION)
#	wav     y	200000	RIFF????WAVE
#
# Real Audio Files
#	ra	y	1000000	\x2e\x72\x61\xfd
#	ra	y	1000000	.RMF
#
#	asf     y       8000000	 \x30\x26\xB2\x75\x8E\x66\xCF\x11\xA6\xD9\x00\xAA\x00\x62\xCE\x6C
#
#	wmv     y       20000000 \x30\x26\xB2\x75\x8E\x66\xCF\x11\xA6\xD9\x00\xAA\x00\x62\xCE\x6C
#
#	wma     y       8000000  \x30\x26\xB2\x75    \x00\x00\x00\xFF
#
#	wma     y       8000000  \x30\x26\xB2\x75    \x52\x9A\x12\x46
#
#	mp3     y    	8000000 \xFF\xFB??\x44\x00\x00
#	mp3     y    	8000000 \x57\x41\x56\45            \x00\x00\xFF\
#	mp3     y    	8000000 \xFF\xFB\xD0\            \xD1\x35\x51\xCC\
#	mp3     y    	8000000 \x49\x44\x33\
#	mp3     y    	8000000 \x4C\x41\x4D\x45\
#---------------------------------------------------------------------	
# WINDOWS REGISTRY FILES
#---------------------------------------------------------------------	
# 
# Windows NT registry
#	dat	y	4000000	regf
# Windows 95 registry
#	dat	y	4000000	CREG
#
#    	lnk     y    	5000	\x4C\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00
#    	chm     y    	100000	\x49\x54\x53\x46\x03\x00\x00\x00\x60\x00\x00\x00\x01\x00\x00
#    	cookie  n    	4096    id=
#    	rdp     y    	4096	\xFF\xFE\x73\x00\x63\x00\x72\x00\x65\x00\x65\x00\x6E\x00\x20\x00\x6D
#
#---------------------------------------------------------------------	
# MISCELLANEOUS
#---------------------------------------------------------------------	
#	(NOTE THIS FORMAT HAS BUILTIN EXTRACTION FUNCTION)
#	zip	y	10000000	PK\x03\x04	\x3c\xac
#	(NOTE THIS FORMAT HAS BUILTIN EXTRACTION FUNCTION)
#	rar	y	10000000	Rar!
#
#	java	y	1000000	\xca\xfe\xba\xbe
#
#	cpp	y	20000	#include	#include	ASCII
#---------------------------------------------------------------------	
# ScanSoft PaperPort "Max" files
#---------------------------------------------------------------------	
#      max   y     1000000    \x56\x69\x47\x46\x6b\x1a\x00\x00\x00\x00   \x00\x00\x05\x80\x00\x00 
#---------------------------------------------------------------------	
# PINs Password Manager program
#---------------------------------------------------------------------	
#      pins  y     8000     \x50\x49\x4e\x53\x20\x34\x2e\x32\x30\x0d

Comment faire pour récupérer ces données ?
Merci à celui qui a une idée.

Dernière modification par xianbroc (Le 16/07/2021, à 09:12)

geole

Re : [Résolu] Perte de données sur disque externe

Bonjour
As-tu vérifié s'il trouvait des choses à récupérer

sudo foremost -w /dev/sdXN

avec XN    lettre et numéro de la partition du disque externe

essaie

sudo foremost ./ -v -q -T  -o /media/xianne/Elements/Recover -t all

NOTA   un conseil:   Il me semble que foremost travaille comme  photorec
alors tu risques de tout récupérer y compris les fichiers que tu connais
alors une idée.
  1) Sauve tous tes répertoires intacts sur le nouveau disque.
  2) Détruis ces répertoires intacts en les écrasant ( wipe )
  3) Lance ta recherche

Dernière modification par geole (Le 14/07/2021, à 15:11)

---

Les grilles de l'installateur https://doc.ubuntu-fr.org/tutoriel/inst … _subiquity
"gedit admin:///etc/fstab" est proscrit,  utilisez "pkexec env DISPLAY=$DISPLAY XAUTHORITY=$XAUTHORITY xdg-open /etc/fstab" Voir  https://doc.ubuntu-fr.org/gedit
Les partitions EXT4 des disques externes => https://forum.ubuntu-fr.org/viewtopic.p … #p22697248

xianbroc

Re : [Résolu] Perte de données sur disque externe

  1) Sauve tous tes répertoires intacts sur le nouveau disque.
  2) Détruis ces répertoires intacts en les écrasant ( wipe )
  3) Lance ta recherche

OK, c'est une bonne idée, je commence par ça.

xianbroc

Re : [Résolu] Perte de données sur disque externe

Sur mon vieil ordi, copier 800 Go de disque à disque prend du temps (environ 10 heures).
Ce serait certainement très long aussi pour le

wipe -r -i -Q 3 -q mes_dossiers

Mais avant d'essayer le

sudo foremost ./ -v -q -T  -o /media/xianne/Elements/Recover -t all

j'ai fouillé dans les dits répertoires et retrouvé ceux que je croyais avoir perdus.

Ainsi, je m'arrête ici, garde en mémoire la bonne technique à utiliser et te dis merci.

Dernière modification par xianbroc (Le 16/07/2021, à 09:12)