mjhjmtu

Accidentally, I installed a new linux distro over a 100G partition of a 250G SSD, with my previous linux. I used it (system upgrades, web browsing) for around 30 minutes before I realised what I did.

It happened around 2019-02-26 22:15:00 -> 22:40:00. I am also interested in a specific directory, my previous home (/home/user). I am not searching for a specific file but everything I can recover.

Afterwards, I dumped the partition to an image. To be sure, I did it with 2 tools: dd and ddrescue. Also, to work with one of this two images (data-recovery process), I have copied it again. The partition is unmounted.

I started with ext4magic, but with no luck. I don't know if I am wrong, but it seems it needs the filesystem where we are trying to recover files. In my case, I cannot recover the previous filesystem.

Some info:

Filesystem in use: /mnt/data/rescue.wip/ddrescue_f_n_sda4.img

Filesystem volume name: <none>
Last mounted on: /
Filesystem UUID: ccb8bdf8-659b-4ad6-84b3-4fd918aee5e6
Filesystem magic number: 0xEF53
Filesystem revision #: 1 (dynamic)
Filesystem features: has_journal ext_attr resize_inode dir_index filetype extent 64bit flex_bg sparse_super large_file huge_file dir_nlink extra_isize metadata_csum
Filesystem flags: signed_directory_hash 
Default mount options: user_xattr acl
Filesystem state: clean
Errors behavior: Continue
Filesystem OS type: Linux
Inode count: 6553600
Block count: 26214400
Reserved block count: 1310720
Free blocks: 23951139
Free inodes: 6317540
First block: 0
Block size: 4096
Fragment size: 4096
Group descriptor size: 64
Reserved GDT blocks: 1024
Blocks per group: 32768
Fragments per group: 32768
Inodes per group: 8192
Inode blocks per group: 512
Flex block group size: 16
Filesystem created: Tue Feb 26 22:20:43 2019
Last mount time: Tue Feb 26 22:31:47 2019
Last write time: Tue Feb 26 22:31:47 2019
Mount count: 2
Maximum mount count: -1
Last checked: Tue Feb 26 22:20:45 2019
Check interval: 0 (<none>)
Lifetime writes: 10 GB
Reserved blocks uid: 0 (user root)
Reserved blocks gid: 0 (group root)
First inode: 11
Inode size: 256
Required extra isize: 32
Desired extra isize: 32
Journal inode: 8
Default directory hash: half_md4
Directory Hash Seed: 5b295e79-85ff-4af7-bef2-e42d1c48dbf8
Journal backup: inode blocks
Checksum type: crc32c
Checksum: 0x0bb27e03


Filesystem in use: /mnt/data/rescue.wip/ddrescue_f_n_sda4.img

|-----------c_time Histogram----------------- after -------------------- Tue Feb 26 10:34:29 2019
1551177962 : 0 | | Tue Feb 26 11:46:02 2019
1551182255 : 0 | | Tue Feb 26 12:57:35 2019
1551186548 : 0 | | Tue Feb 26 14:09:08 2019
1551190841 : 0 | | Tue Feb 26 15:20:41 2019
1551195134 : 0 | | Tue Feb 26 16:32:14 2019
1551199427 : 0 | | Tue Feb 26 17:43:47 2019
1551203720 : 0 | | Tue Feb 26 18:55:20 2019
1551208013 : 0 | | Tue Feb 26 20:06:53 2019
1551212306 : 0 | | Tue Feb 26 21:18:26 2019
1551216599 : 204037 |**************************************************| Tue Feb 26 22:29:59 2019


|-----------d_time Histogram----------------- after -------------------- Tue Feb 26 10:34:29 2019
1551177962 : 0 | | Tue Feb 26 11:46:02 2019
1551182255 : 0 | | Tue Feb 26 12:57:35 2019
1551186548 : 0 | | Tue Feb 26 14:09:08 2019
1551190841 : 0 | | Tue Feb 26 15:20:41 2019
1551195134 : 0 | | Tue Feb 26 16:32:14 2019
1551199427 : 0 | | Tue Feb 26 17:43:47 2019
1551203720 : 0 | | Tue Feb 26 18:55:20 2019
1551208013 : 0 | | Tue Feb 26 20:06:53 2019
1551212306 : 0 | | Tue Feb 26 21:18:26 2019
1551216599 : 914 |**************************************************| Tue Feb 26 22:29:59 2019


|-----------cr_time Histogram----------------- after -------------------- Tue Feb 26 10:34:29 2019
1551177962 : 0 | | Tue Feb 26 11:46:02 2019
1551182255 : 0 | | Tue Feb 26 12:57:35 2019
1551186548 : 0 | | Tue Feb 26 14:09:08 2019
1551190841 : 0 | | Tue Feb 26 15:20:41 2019
1551195134 : 0 | | Tue Feb 26 16:32:14 2019
1551199427 : 0 | | Tue Feb 26 17:43:47 2019
1551203720 : 0 | | Tue Feb 26 18:55:20 2019
1551208013 : 0 | | Tue Feb 26 20:06:53 2019
1551212306 : 0 | | Tue Feb 26 21:18:26 2019
1551216599 : 206292 |**************************************************| Tue Feb 26 22:29:59 2019
ext4magic : EXIT_SUCCESS
Filesystem in use: /mnt/data/rescue.wip/ddrescue_f_n_sda4.img

Using internal Journal at Inode 8
Activ Time after : Tue Feb 26 10:34:29 2019
Activ Time before : Tue Feb 26 22:30:00 2019
Error: Inode not found for "/home/user"
Check the valid PATHNAME "/home/user" and the BEFORE option "Tue Feb 26 22:30:00 2019
"
ext4magic : EXIT_SUCCESS

As you can see, it cannot find the pathname "/home/user", mainly because the current filesystem does not have a "/home/user". So, it seems it is not searching in the previous filesystem. I also tried with different datetimes around 22:30.

I am not centered in ext4magic, but I started with it. I read about other tools: extundelete, testdisk or photorec.

What would be the best approach to recover every dir/file that existed before overwritting the partition (eg. at 2019-02-26 21:00:00) under the directory /home/user? Any recommedation?

I have tried photorec a few times before, but it is a huge mess to detect and re-organise those thousands-to-millions of files because they don't preserve location/path/name. In case this is the only solution, what would you recommend to "semi-automatic re-organisation"?