How to restore deleted files on CNM minibook

[Huskypete]

Hi all,
 
I recently deleted everything on my minibook by accident and I was wondering whether anyone knew of any way to recover deleted files. I know that CNM minibooks use a really obscure operating system so I have been unable to find any software that will do the job.

Please help

Cheers

[Mijzelf]

The OS is absolutely not obscure, it's just Linux. And I *think* your data is still there, but I'm not sure.
The filesystem is jaffs2, which is a filesystem especially designed for raw flash memory. Flash memory needs a special treatment for accessing. It can be written bitwise, but only in one direction. A '1' can be made '0', but not the other way around. Erasing can only be done in large blocks (usually 64kB). So when a new file is written, it needs a block completely filled with '1'. If that is not available, a large block needs to be erased.
The question now is: Does the filesystem erase the 64kB block directly when the contents becomes obsolete, or does it wait until the space is needed again.
In the first case most of your data will be gone. In the second case it's still there, until it's overwritten.

In the forum you can find directions how to boot your system from a SD card. When you do that, you can copy the (raw) content of the flashmemory to the SD card, or to an USB stick, and depending on the nature of the data try to recover it with various tools from another system.

[Huskypete]

Thanks, I'll try that later on.

You may have seriously saved my ass on this one,

Cheers

[Huskypete]

I think that I've now got the raw data on my SD card. What file extensions should I be looking for? Also, do you have any advice for the best software to use to recover my files from it?

Thanks again,

Pete

[Mijzelf]

You used the dd command to copy the data, I hope?

I don't know if it makes sense to search for extensions, because I don't know how jffs2 marks a file as deleted. I'd try the 'deep scan' option of Recuva first. If the files you are searching for are plain text, then this won't work, I'm afraid, because Recuva searches for known headers, which cannot be found in plain text files.
There are some ways to recover plain text files (well, not really, only their contents), but they are all labor intensive, because the data has to be picked manually from the garbage.
Assuming you copied the flash to a file, you could do a 'dd if=file.raw | strings >file.txt' to filter all textdata from the raw data. This will give a huge textfile full of garbage, in which you can search for keywords. The text around the keywords might be the text you are searching for.

[Huskypete]

The only options I was faced with were format the drive or covering the drive without formatting. Was there something else I was supposed to have done to copy the data across? I chose covering incidentally.

I've tried recova and it hasn't found anything other than jpg files so far so not looking good

[Robin]

In my experience the recover and save option does not work reliably.  

Was there something else I was supposed to have done to copy the data across?

In hindsight ... back up your data to SD or USB or Extend_1, then format and recover.
As Extend_1 is a separate drive it makes sense to use it for (all) your own files.
As said previously, if you have not formatted, your data may well be there.
I am not clear ...
The suggestion to boot from SD Card

boot your system from a SD card

is different from using a recovery image on an SD card.
When you use the recovery image it is offering to recover the LLL to factory defaults, the save option is offering to try to save your data alongside the new operating system.
...
back to your first question,

whether anyone knew of any way to recover deleted files

Deleted files are moved to  the hidden folder .trash.
Hidden filenames and foldernames all start with a . and can be found with your file manager, drop down the "View" menu, Check "Show Hidden Files".

Edit
I started to answer this question at a beginner level ... if it is pitched wrong, my humble apologies.
And welcome to the forum, Huskypete. 
Cheers

[Mijzelf]

How did you get the raw data from the flash? AFAIK the jffs2 filesystem works cyclic to prevent wearing. So your data could still be there.
The procedure for backing up the raw data is:
Plug in an USB stick of at least 1GB. then open a terminal and type:

Code: [Select]

umount /dev/sda1 # might give an error, that's no problem
dd if=/dev/nand of=/dev/sda1When this is finished, remove the stick, and let recuva analize it with a deep scan.

[Huskypete]

Ok, I have tried what you suggested but I think I have formatted in the process so I've probably lost it all

The whole thing refused to reload so I had to format to install the recovery file.

Then I tried what you said but it came back with 'insufficient space on your SD card' (its an 8gb card)

Seems likely now that I've foolishly overwritten the data but thanks for your help all the same.

[Mijzelf]

Then I tried what you said but it came back with 'insufficient space on your SD card' (its an 8gb card)

Then you did not what I said, as dd doesn't know about SD cards. It's doing a low level copy from one blockdevice to another. By the way, to copy to an SD card the command should be:

Code: [Select]

dd if=/dev/nand of=/dev/mmc0p1