Undelete an "rm -r" on an exfat external hard disk device

Question

There are several questions about how to undo an rm -r command, however in this specific case I have an exfat formatted partition / hard disk, rather than, for example, and ext4/ext3 formatted disk.

The disk is an external disk, and so as I haven't written anything to the disk since running the rm -r command, the data should be fully recoverable. (Nothing should have been over-written.)

So a brief summary of what I did was:

• I have an external 2TB disk, which I use to backup my data for a particular project.
• I tried to copy that data to a NAS by plugging in the external disk (via USB) and running a cp -r command to copy data.
• I didn't realize that where I was copying the data to wouldn't have enough free space. So the cp -r command failed reporting not enough disk space.
• Since the destination location was my home directory, I ran rm -r on the 3 subfolders which were copied from the root of my external disk.
• Oops, that rm -r command was actually run on the root of my external disk, NOT my home dir.

So I have a partial copy of the data on the disk where my home directory is. Unfortunately this is only about 50 GB of about 1.2 GB...

(By the way if any of the above isn't clear leave a question in the comments and I will clarify.)

I know the names of the 3 subfolders which were on my external drive root.

How can I restore the subdirectory "tree". (I know the data for the files will still be there, but that the data structure which points to the files specifying which folders they are in will have been erased? I think? I'm not 100% sure on how exfat data is formatted on a disk...)

So far I have tried testdisk. What I have done is a scan for deleted files and folders to a new log file on a local nas disk. Unfortunately this is taking an exceedingly long time, and I think testdisk will just dump all the files it finds into one folder... which is no good because I had many files with the same names in different subfolders on the external disk.

So I have 2 problems:

• By my calculations it will take about half a year to complete the scan. (At the rate it is running now.)
• I think the subfolder heirachy will not be restored and all files will be put into one subfolder in the recovery location.

Questions:

• Will testdisk restore the subfolder heirachy or dump everything in a single folder?

• Is there a faster method to undo the rm -r command which I ran on my exfat formatted external hard disk?

Note that the rm -r command deleted probably about 1000000 files from the disk... so I guess what I am hoping for is some way to batch undelete large quantities of files?

Answer 1

testdisk is amazing! - I accidentally selected "delete all" on my Fuji X-S10 camera instead of "delete one", which deleted 2 days worth of videos and photos (this is from a 128GB SD card formatted with exFAT).

I found this thread and decided to try testdisk on my Mac (M1).

I followed these instructions:

1. Ensure the disk is not mounted (use Disk Utility to unmount, but do not eject)
2. sudo testdisk
3. [Create] a new log file
4. Select the corresponding "/dev/rdisk*" (don't use /dev/disk as it's slower, check with Disk Utility for the correct number)
5. Under Advanced select "Undelete"
6. Select the files you wish to undelete and press "C" to copy them somewhere safe

This restored all of my files with no data loss, I am super chuffed!

Answer 2

Is there a faster method to undo the rm -r command which I ran on my exfat formatted external hard disk?

ExFat deletes files by marking each file and directory entry with a symbol (0xe5 as the first byte), and also removing the pointer to the file entry so that the blocks are freed up. There is no second file table, so once it is done, it is not feasible to correct. AFAIK there is no other method to undelete a file with ExFat on linux.

Will testdisk restore the subfolder heirachy or dump everything in a single folder?

Testdisk, which is used for partition and file system recovery, allows you to find files listed in the file system as deleted, with the caveat of those files hopefully not having been overwritten. In this case, you can "undelete" the files, which is copying the file starting at the innodes listed, with filename and other information intact.

This includes the folder hierarchy, sometimes. I just used it recover 1440 photos from a corrupt Canon Camera SD card formatted as ExFat. I could see the files on the camera, but not when I put the SD card in my Mac. Testdisk could see the corrupt/deleted folder, and I could recover the files with at least 2 levels of folder structure. This should be the same for you having used rm. Had there been an intermediate step of putting all those files in a trash or recycling bin, then it might not have your existing folder structure.

The other tool that comes with TestDisk is PhotoRec, which is a low level disk analyzer that searches for file structures, ignoring the file system. This is when you delete a partition or the file system is completely hosed. As the actual data do not have names, this is done by the File System or OS, all the files would be unnamed and without folder structure.

The speed of TestDisk, is essentially the same speed as any file copy, depending on the speed of your disk, computer, or OS.

Answer 3

As far as I recall, testdisk won't just dump any file directly into a directory. Instead, it will prompt you, one file at a time.

Now, what you need to do is be careful. When you restore a file, testdisk may write that file to the drive, potentially ruining the ability to restore other files. The solution is to have testdisk restore files TO a different drive than the drive that testdisk is restoring files FROM.

And, yeah, I've felt like testdisk is pretty slow.

Unfortunately, I don't know of a simpler way to restore from exFAT, and I'm not sure if there is one. The ability to "UNDELETE" was popular around the times of DR-DOS 5 and MS-DOS (6, maybe 5). However, businesses have learned that the better approach is to have data properly backed up. So, there's been less interest in being able to UNDELETE. By the time exFAT rolled around, interest in undeleting has diminished. I suggest you consider yourself lucky that testdisk supports exFAT.

I don't think exFAT is very different from FAT32. I'm betting that FAT32 and FAT16 are decently supported by some open source tools. So, it wouldn't be too hard for someone to write a nice exFAT undeleter.