Arch Linux

rgzfxf6bhu

Member

Registered: 2015-10-30

Posts: 101

Recover files with extundelete - Segmentation fault

I accidentally removed a file on a LUKS encrypted partition and want to restore it now. First I unmounted (but didn't close) the LUKS partition. So extundelete should be have access to it.

I tried:

sudo extundelete /dev/mapper/luks --restore-file dic/file.ext -o /RECOVER/

But I only get:

NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 7453 groups loaded.
Loading journal descriptors ... Segmentation fault

Is there anyway how to deal with the segmentation fault?

brainfucksec

Member

Registered: 2017-03-01

Posts: 40

Website

Re: Recover files with extundelete - Segmentation fault

Segmentation fault is a permission error, exactly the error mean: "You can't write in that space of memory", in this case if encrypted partition isn't mounted you can't read/write on it. You need to mount encrypted volume from a Live ISO (Ubuntu is a good choice), decrypt it, then use "Photorec" for file recovery and select an external drive for recovered files.

Photorec tutorial --> http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

Last edited by brainfucksec (2017-10-03 18:57:42)

---

--= [ |<!55 ]=--

rgzfxf6bhu

Member

Registered: 2015-10-30

Posts: 101

Re: Recover files with extundelete - Segmentation fault

Sorry for the late reply, kind of missed your answer

... if encrypted partition isn't mounted you can't read/write on it...

Well I am not sure if this is correct!? If I understand extundelete correctly, it the partition doesn't need to be mounted.
cryptsetup open should be enough, right?

I wanted to use extundelete because it restores filenames and with Photosec I was able to restore some files, but not with the correct filenames.

seth

Member

From: Don't DM me only for attention

Registered: 2012-09-03

Posts: 71,680

Re: Recover files with extundelete - Segmentation fault

No, it's not.
A segfault is an access violation wrt. the process memory. Though unexpected IO failiure can cause a segfault, it's not (related to) a segfault by itself.
Exundelete operates on partitions, if anything, mounting will harm it. See https://wiki.archlinux.org/index.php/Fi … very#Usage

I do however not know whether and how it works on encrypted filesystems.

To deal with a segfault, first and foremost generate a backtrace (using gdb) but tbh, after more than two weeks the data is most likely gone (if you've been using the partition in the meantime) :-(

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

satrapes

Member

Registered: 2018-09-25

Posts: 7

Re: Recover files with extundelete - Segmentation fault

I accidentally removed a file on a LUKS encrypted partition and want to restore it now. First I unmounted (but didn't close) the LUKS partition. So extundelete should be have access to it.

I tried:

sudo extundelete /dev/mapper/luks --restore-file dic/file.ext -o /RECOVER/

But I only get:

NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 7453 groups loaded.
Loading journal descriptors ... Segmentation fault

Is there anyway how to deal with the segmentation fault?

Yes apparently it has to do with the version of e2fsprog. I found it in the following link. Please mark this as closed.
https://bugs.archlinux.org/task/56585#comment168229