Source: /data/temp/gb1/img/13.UDA.img
Copied image: /data/temp/gb1/img/UDA/13.UDA.img
Source apparent size: 419430400 bytes
Source SHA-256: 8f4866ede3aae2e356fb1ce2d6271b5ee8ab466424eb0006fb662cc1f9b0edaa
Initial file type: data
Possible ext4 superblock magic at offset 180474936; carved candidate filesystem from offset 180473856.
dumpe2fs read the ext4 superblock, but returned non-zero because the filesystem is truncated.
The superblock reports 31,058,432 blocks at 4096 bytes each, much larger than the 238,956,544 bytes available after the carve offset.
e2fsck -fn stopped on short reads from missing later blocks; see recovery/e2fsck.carved_ext4.readonly.txt.
debugfs normal mode could not open the filesystem because allocation bitmaps were missing.
debugfs catastrophic/read-only mode listed some root directory entries, but rdump could not recover file contents; see recovery/debugfs_rdump.txt.
Wrote signature scan with 200 hit(s) to recovery/signature_hits.txt.
Captured first 5000 strings to recovery/strings.first5000.txt.

Second-pass findings:
The carved ext4 filesystem was padded sparsely to its superblock-declared size: recovery/carved.ext4.padded.img.
The padded image mounted read-only with journal replay disabled, but most root entries point to missing metadata and return EBADE/Bad message.
Recoverable mounted entries were copied to recovery/extracted_ext4_padded: /bin -> usr/bin, /lib -> usr/lib, /sbin -> usr/sbin, lost+found, and .jetsonclocks_fan.txt.
Validated loose carving recovered 10 payloads under recovery/validated_carves:
- 2 ARM64 Linux kernel Image payloads
- 4 ARM64 ELF binaries
- 4 valid gzip streams, including kernel/system logs and Linux kernel config text
The validated carve report is recovery/validated_carve_report.json.
The temporary padded-image mountpoint was unmounted after extraction.