Right. That did it.

Getting into the menu, this time, shows what I needed.

[code]
Keyword Search of Allocated and Unallocated Space
Enter the keyword string or expression to search for:
__________________________________

-----------------------------
[X] ASCII [X] Unicode
[ ] Case Insensitive [ ] grep Regular Expression

And so I enter "AVI LIST" and...

miro@gbn ~ $ date --rfc-3339=seconds
2015-05-10 05:23:34+02:00
miro@gbn ~ $ 

tab and follow "Search".

Finally. It says on an otherwise empty page with just the same menu on top:
"Searching for ASCII", and then just the progress in the very bottom in the
status line, such as:
"Received 458 B, avg 5 B/s, cur 0 B/s".

And in the other computor, where I have `top' fired up all the time, this
shows:

[code]
top - 05:27:19 up 38 days, 17:30,  3 users,  load average: 0.95, 0.48, 0.22
Tasks: 229 total,   3 running, 225 sleeping,   1 stopped,   0 zombie
%Cpu(s): 16.7 us,  3.3 sy,  0.0 ni, 79.8 id,  0.1 wa,  0.0 hi,  0.1 si,  0.0 st
KiB Mem : 16385720 total,  2194860 free,   829944 used, 13360916 buff/cache
KiB Swap: 20971516 total, 20882992 free,    88524 used. 15456620 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND                               
27868 root      20   0    6416    792    708 R  99.7  0.0   3:01.43 srch_strings                          
27867 root      20   0   29908   3300   2920 S  19.2  0.0   0:32.89 blkls                                 
27869 root      20   0   11584   2016   1892 S   4.6  0.0   0:14.10 grep                                  
12433 root      20   0  176116  18360   4060 S   2.6  0.1  17:04.24 X                                     
10091 root      20   0   25088    772    128 R   0.7  0.0  38:03.88 top              
[/code]

-------
But after a few hours sleep I realized that I was doing the wrong search... I
forgot to load the unallocated! Even the title of the search said so, it said:

"Keyword Search of Allocated and Unallocated Space"

as I cared to paste what I was doing. So I killed those jobs, and had to
restart the browser a few times, as after loading the unallocated space, it
would perform those immediately finished searches that found nothing for some
reason.

And in experimenting how to start the right search, I have just made a few
tries, but I couldn't go for exactly what I wanted, but rather, and it will
come to the same result in slightly different way, [but rather] what these
listings and logs will tell you.

In the first place, here's the failed and the duplicated current searches:

[code]
gbn ~ # ls -ltr /mnt/g5n-C/autopsy/g5nCmn/g5n/output/ | tail -9
-rw-r--r-- 1 root root           18 2015-05-10 08:48 vgn-Cmn-0-0-ext-2.unalloc-4.srch
-rw-r--r-- 1 root root           20 2015-05-10 08:48 vgn-Cmn-0-0-ext-2.unalloc-5.srch
-rw-r--r-- 1 root root           18 2015-05-10 08:49 vgn-Cmn-0-0-ext-2.unalloc-6.srch
-rw-r--r-- 1 root root           20 2015-05-10 08:49 vgn-Cmn-0-0-ext-2.unalloc-7.srch
-rw-r--r-- 1 root root           18 2015-05-10 08:51 vgn-Cmn-0-0-ext-2.unalloc-8.srch
-rw-r--r-- 1 root root           20 2015-05-10 08:51 vgn-Cmn-0-0-ext-2.unalloc-9.srch
-rw-r--r-- 1 root root   7626432512 2015-05-10 09:22 vgn-Cmn-0-0-ext-2.unalloc-blkls.asc
-rw-r--r-- 1 root root    813826048 2015-05-10 09:22 vgn-Cmn-0-0-ext-2.unalloc-blkls-2.asc
-rw-r--r-- 1 root root   3439091712 2015-05-10 09:22 vgn-Cmn-0-0-ext-2.unalloc-blkls-1.asc
gbn ~ # 
[/code]
The short ones are the failed, and the three ones are the duplicated.

And to those correspond these lines:

[code]
gbn ~ # cat /mnt/g5n-C/autopsy/g5nCmn/g5n/logs/miroR.log | tail -12
Sun May 10 08:48:32 2015: vgn-Cmn-0-0-ext-2.unalloc: ASCII, Unicode, search for AVI LIST
Sun May 10 08:49:07 2015: Host g5n opened
Sun May 10 08:49:10 2015: vol1: volume opened
Sun May 10 08:49:34 2015: vgn-Cmn-0-0-ext-2.unalloc: ASCII, Unicode, search for AVI LIST
Sun May 10 08:49:56 2015: vgn-Cmn-0-0: Directory listing of /1/ (2)
Sun May 10 08:51:14 2015: Host g5n opened
Sun May 10 08:51:25 2015: vol1: volume opened
Sun May 10 08:51:26 2015: vgn-Cmn-0-0: Directory listing of /1/ (2)
Sun May 10 08:51:57 2015: vgn-Cmn-0-0-ext-2.unalloc: ASCII, Unicode, search for AVI LIST
Sun May 10 08:52:19 2015: vgn-Cmn-0-0-ext-2.unalloc: Saving ASCII strings to output/vgn-Cmn-0-0-ext-2.unalloc-blkls.asc
Sun May 10 09:02:19 2015: vgn-Cmn-0-0-ext-2.unalloc: Saving ASCII strings to output/vgn-Cmn-0-0-ext-2.unalloc-blkls-1.asc
Sun May 10 09:16:00 2015: vgn-Cmn-0-0-ext-2.unalloc: Saving ASCII strings to output/vgn-Cmn-0-0-ext-2.unalloc-blkls-2.asc
gbn ~ # 
[/code]

and also these:

[code]
gbn ~ # cat /mnt/g5n-C/autopsy/g5nCmn/g5n/logs/miroR.exec.log | tail -18
Sun May 10 08:47:20 2015: '/usr/bin/blkls' -e -f ext -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn' | '/usr/bin/srch_strings' -a -t d -e l | '/bin/grep'  'AVI LIST'
Sun May 10 08:47:20 2015: '/usr/bin/blkls' -e -f ext -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn' | '/usr/bin/srch_strings' -a -t d -e l | '/bin/grep'  'AVI LIST'
Sun May 10 08:47:20 2015: '/usr/bin/blkls' -e -f ext -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn' | '/usr/bin/srch_strings' -a -t d -e l | '/bin/grep'  'AVI LIST'
Sun May 10 08:48:32 2015: '/usr/bin/blkcat' -f ext -s -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn'
Sun May 10 08:48:32 2015: '/usr/bin/blkls' -e -f blkls -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' | '/usr/bin/srch_strings' -a -t d | '/bin/grep'  'AVI LIST'
Sun May 10 08:48:32 2015: '/usr/bin/blkls' -e -f blkls -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' | '/usr/bin/srch_strings' -a -t d -e l | '/bin/grep'  'AVI LIST'
Sun May 10 08:49:34 2015: '/usr/bin/blkcat' -f ext -s -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn'
Sun May 10 08:49:34 2015: '/usr/bin/blkls' -e -f blkls -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' | '/usr/bin/srch_strings' -a -t d | '/bin/grep'  'AVI LIST'
Sun May 10 08:49:34 2015: '/usr/bin/blkls' -e -f blkls -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' | '/usr/bin/srch_strings' -a -t d -e l | '/bin/grep'  'AVI LIST'
Sun May 10 08:49:56 2015: '/usr/bin/fls' -f ext -la  -s '0' -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn' 2
Sun May 10 08:51:26 2015: '/usr/bin/fls' -f ext -la  -s '0' -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn' 2
Sun May 10 08:51:57 2015: '/usr/bin/blkcat' -f ext -s -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn'
Sun May 10 08:51:57 2015: '/usr/bin/blkls' -e -f blkls -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' | '/usr/bin/srch_strings' -a -t d | '/bin/grep'  'AVI LIST'
Sun May 10 08:51:57 2015: '/usr/bin/blkls' -e -f blkls -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' | '/usr/bin/srch_strings' -a -t d -e l | '/bin/grep'  'AVI LIST'
Sun May 10 08:52:04 2015: '/usr/bin/blkcat' -f ext -s -o 0 -i raw '/Cmn/autopsy/g5nCmn/g5n/images/vgn-Cmn'
Sun May 10 08:52:19 2015: '/usr/bin/srch_strings' -a -t d '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' > '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc-blkls.asc'
Sun May 10 09:02:19 2015: '/usr/bin/srch_strings' -a -t d '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' > '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc-blkls-1.asc'
Sun May 10 09:16:00 2015: '/usr/bin/srch_strings' -a -t d '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc' > '/Cmn/autopsy/g5nCmn/g5n/output/vgn-Cmn-0-0-ext-2.unalloc-blkls-2.asc'
gbn ~ # 
[/code]

The ASCII searches have all just ended. Three equal size files in the output:

[code]
gbn ~ # ls -ltr /mnt/g5n-C/autopsy/g5nCmn/g5n/output/ | tail -4
-rw-r--r-- 1 root root  22340380170 2015-05-10 11:17 vgn-Cmn-0-0-ext-2.unalloc-blkls.asc
-rw-r--r-- 1 root root  22340380170 2015-05-10 11:39 vgn-Cmn-0-0-ext-2.unalloc-blkls-1.asc
-rw-r--r-- 1 root root  22340380170 2015-05-10 11:45 vgn-Cmn-0-0-ext-2.unalloc-blkls-2.asc
-rw-r--r-- 1 root root         4096 2015-05-10 11:47 vgn-Cmn-0-0-ext-2.unalloc-blkls.uni
gbn ~ # 
[/code]

One unicode search only has finished, IIUC. Two more going on. It's an ext4, and I should probably be better off killing the unicode searches jobs, but I'm uncertain, and another hour or not much more is irrelevent in all the time needed for a recovery like this.

I'm not sure, but I think it's best to just wait for all the searches to finish.

Nope, only the ASCII searches are done:
[code]
-rw-r--r-- 1 root root       913408 2015-05-10 12:09 vgn-Cmn-0-0-ext-2.unalloc-blkls.uni
[/code]

Nope, it's worse than that. In the next post.