On 3 March 2015 at 12:52, Mark Rogers mark@more-solutions.co.uk wrote:
I *might* be making some progress, or on the other hand...
OK, it looks like I might have ALUG stumped now? :-) Thanks for all the suggestions that got me this far.
Looking at the data from dumpe2fs the file system was older than expected, or more to the point older than the files I was hoping to recover, and that lead me in other directions and I found the files elsewhere[1]. However, I feel like I'm on the verge of learning something useful here so for academic reasons only I'd like to continue seeing what I can can achieve here.
In particular, I'd like to understand the relationship between the C/H/S values that testdisk gave me for the start and end of the ext2 partition (start: 3/112/46), and the start/end values that fdisk subsequently gave me for the same partition (start: 55296)?
Does anyone have any pointers to good reading on this subject? The Internet is vast and on this subject the problem seems to be finding a good primer amongst the massive amount of information on the subject.
[1] Lateral thinking: The files had been uploaded to a server, long since decommssioned. The backup of that server had also been deleted long ago, but a backup of the backup had survived on a different server. Turns out that it's surprisingly hard to actually get rid of data completely!