My friend doesn’t have any backup of valuable data. I would like to ask if someone has experience with data recovery, or knowledge about the factory reset process?
Is the reset securely overwriting all user data (with tools like shred or similar), a simple delete, or is it merely replacing the filesystem or partition?
Is there any point in trying to use filesystem forensics to recover something?
I would greatly appreciate any success story that anyone could share.
I asked a KI, that suggested to try extundelete, testdisk and photorec.
But first i have to create a linux live-system usb-stick for my windows-computer… So it will take its time, but i will report here.
Recommendations and Suggestions are welcome, if you have something for me.
Just to say that I tried and failed to get my nextbox to boot from an external usb-stick. It always wanted to boot from the internal card. An AI advised how to fix this but its advice didn’t work.
That’s unfortunate. My approach is to disassemble the Nextbox and connect the hard drive to a notebook. But I need Linux on the notebook to gain access to the hard drive. So I want a Linux Live USB stick for the notebook, not for the Nextbox, because I don’t have Linux running yet.
I recently did the data recovery and wanted to share my mixed results.
I tried extundelete and TestDisk first, but neither produced anything useful. In some cases extundelete can work if the disk was cut from power immediately after the reset button was pressed, but that wasn’t my situation.
I then used PhotoRec. PhotoRec scans free space for known file signatures and restores files based on those patterns. It works best when data isn’t heavily fragmented, but it completely loses original filenames and folder structure. The recovery output ended up as many folders containing ~500 files each.
A few practical observations:
Some recovered plain text files were actually concatenated fragments from two or more original files.
PhotoRec recovered a large number of system files. The Nextbox extracts updates to the data disk, and those deleted update files were recovered as well.
Files that are distinct from system files are more likely to be usefully recovered. Recovering personal code (e.g., Python files) is difficult unless you had a unique header or marker in your files.
If a recovered file contains a timestamp in its metadata, PhotoRec will use that timestamp in the filename, which helps identify and sort personal photos. Images from messaging apps or otherwise anonymized sources are much harder to match up cleanly.
Summary: PhotoRec can recover many file types, but expect lost filenames/folders, mixed or fragmented text, and lots of system-file clutter. Regular backups remain the safest solution.
