This comes from a long story of trying to recovering a TrueCrypt volume from a hardware failure (thanks, WD). I ended up with an unencrypted 3TB image that had the files that I want to recover.
Unfortunately, after using
extundelete, I guessed the directory entry that leads to the descriptors (of the additional directories) that I want to recover has been overwritten.
However, I think that its subdirectories may have their entries still intact. I would like to know how can I search throughout the disk image for directory entries in unallocated blocks, in order to recover their files (with their proper names, which would be much better than using
photorec and the like).
I know that
extundelete with a default
--recover-all doesn't look further than the tree that spawns from the root directory. Okay, what if one of the branches is broken but I know that the subfolders entries are somewhere?
Just in case I didn't express myself clearly, imagine that the entry lost is [root]/information. The root directory has the 'information' entry, but it points to overwritten data. Its directory entry is gone, but I want to scan for its subdirectories, [root]/information/personal, and [root]/information/business, and so on. (the name of those subdirectories was in the 'information' entry- I don't care about that name but their whole structure)
fsckshould gather recoverable files in
fsckdoesn't care about deleted entries, right? Maybe I can try to manually set the 'information' entry in [root] as undeleted? (well, still its children will be marked as deleted, right?) Mmm....
photorecperform file recovery based on header search. However, I would prefer a tool that does search for orphan directory entries instead of files, so I can recover the files in a better way.