Questions[undelete](server)

I am using extundelete to recover about 9000 files that were deleted from an AWS EBS volume, accidentally via programmatic error.

The end of the report states

2864 recoverable inodes still lost.

Can anyone explain what this means, and how I can recover the unrecoverable using extundelete

Full shell output

NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 240 groups loaded.
Loading journal descriptors ... 30077 descriptors loaded.
Searching for recoverable inodes in directory /srv/www/mysite.com/photo-gallery ...
9000 recoverable inodes found.
Looking through the directory structure for deleted files ...
Unable to restore inode 330 (srv/www/mysite.com/photo-gallery/group56/myimage7.jpg): Space has been reallocated.
Unable to restore inode 1179649 (srv/www/mysite.com/photo-gallery/group189/myimage5.jpg): Space has been reallocated.
2864 recoverable inodes still lost.

I accidentally moved a file onto an existing file and need to recover the old file.

original file: /mnt/FILE (was around 1 GB)

new file: /mnt/FILE (now is 17 bytes)

command:

mv SOMEFILE /mnt/FILE 

First I have unmounted the filesystem the file resides on, i.e.

umount /mnt

Ran a hdparm --fibmap on the updated /mnt/FILE to get the following:

 filesystem blocksize 4096, begins at LBA 0; assuming 512 byte sectors.
 byte_offset  begin_LBA    end_LBA    sectors
           0  342898376  342898383          8

I am trying to run a dd on the device where /mnt/FILE is (/dev/xvdb) to copy out the blocks from the larger file:

dd if=/dev/xvdb of=/tmp/FILE bs=4096 skip=342898376 count=1000000000 iflag=skip_bytes,count_bytes

I don't seem to be getting the right blocks, could you please advise me how to do so.

User accidentally deleted directory with firm data on laptop with Windows 8. I booted Ubuntu liveCD but using :

$sudo fdisk -l

WARNING: GPT (GUID Partition Table) detected on '/dev/sda'! The util fdisk doesn't support GPT. Use GNU Parted.


Disk /dev/sda: 750.2 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders, total 1465149168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x4ad209d2
Device Boot      Start         End      Blocks   Id  System
/dev/sda1               1  1465149167   732574583+  ee  GPT
Partition 1 does not start on physical sector boundary.

and

$ sudo ntfsundelete /dev/sda1

returned all files with flag F..! and impossible to undelete.

How to get back these files? (history for specified directory and bin on Win8 of course are empty).

A user deleted a directory containing an important file over a Samba share. Share was from a Nexenta box running ZFS, raid-Z3.

Last backup was 12 hours ago - is there a way to recover the 1 day's work?

Edit:
Asked about topic on Nexenta forums, similar responses.

My MD had a clear out of her mailbox (anything from september 2011 back to 2005 was deleted!) she is now majorly regretting this as there was contracts etc etc in there.

Now I have looked in OWA but the deleted items are all gone, what gives me a glimmer of home is that in exchange I am still seeing 40K items under her AD account not 2.5K.

Is there any way to get these messages back through Exchange as it is still showing all messages as stored?