Extract Surviving Data from Dropped Collections

I. Protect the Scene and Prepare Scan Evidence

Preserve sources first as described in Protect the Recovery Scene.

II. Recover Collections Using Directory Maps

Preserve readable WiredTiger.turtle, WiredTiger metadata, MongoDB catalog, matching collections and history files. Declared directory-extent sources can supplement missing files, but directory roots and source relationships must be evidenced.

MONGODBDATA=/recovery-input/mongodb/source/dbpath
DIRECTORY_EXTENTS=/recovery-input/mongodb/source/directory-extents.json

Have the source engineer prepare the extent manifest in the project format, recording logical files and actual block sources. Do not automatically merge same-named files from other disks into the collection or force conflicting attribution.

param sourceversion 8.0.0;
param sourcekind copy;
param sourcefrozen true;
b;
ds catalog status;
\l;
use appdb;
\dt;
unload db appdb;

III. Use Declared File Extents

When logical ranges and block sources for a file are confirmed, preserve the mapping with EXTENT_MAP. This path can read pages and overflow across known extents. Retain reasons for undeclared holes without substituting zero-filled content.

DISK_PATH=/recovery-input/mongodb/source/image-source
EXTENT_MAP=/recovery-input/mongodb/source/collection-extents.json
SOURCE_VERSION=8.0.0
SOURCE_KIND=imagecopy
SOURCE_FROZEN=true
RESMODE=all

ds idx;
ds idx status;
ds unload all;

IV. Scan an Unmapped Image

Without directory and file mappings, scan only independent complete blocks within an explicit range. Replace the example values with confirmed offsets and the exclusive end position. This path requires empty MONGODBDATA and EXTENT_MAP, with imagecopy and all.

MONGODBDATA=
EXTENT_MAP=
DISK_PATH=/recovery-input/mongodb/source/image-source
SOURCE_VERSION=8.0.0
SOURCE_KIND=imagecopy
SOURCE_FROZEN=true
RESMODE=all
EXMODE=bson
DSOFF=193
SCAN_END=24512
SCAN_STEP=512

ds idx;
ds idx status;
ds unload all;
ds log;

V. Supplement Historical and External Dependencies

When directory recovery needs older versions, read base values and version chains from the history store linked by the matching catalog. If history store is incomplete, export only confirmed independent branches and keep missing versions marked as unknown.

ds hs scan appdb.orders;
ds hs unload appdb.orders;

VI. Scan Plaintext Document and Field Fragments

PDU provides plaintext BSON and scalar-field fragment scanning. Complete-document candidates, field fragments and suspected structures are retained separately without automatically confirming collection names, business snapshots or record relationships. This path also performs bounded decoding of surviving Snappy/zlib/zstd fragments and retains readable prefixes. It does not recreate missing bytes or decrypt encrypted sources.

ds fragments idx;
ds fragments status;
ds fragments unload documents;
ds fragments unload fields;
ds fragments unload structures;

VII. Continue the Recovery Task

Keep the task directory and repeat ds idx or the original export command with the same source and configuration. Batch records identify completed output units. If an unfinished unit has an uncertain state, check PDU's records and decide whether to keep or abandon it. Do not delete the task directory to restart.

ds idx status;
ds batch status;
ds batch log;

After export, record the native success and failure counts, unresolved dependencies and original errors reported by PDU, and retain the checkpoint. Resume uses native records and file metadata such as existence and size without rereading exported data.

Output Files

Collection data is exported as BSON files or Canonical Extended JSON line files. Recovery commands generate offline candidate data without writing to the target database. Native records retain sources, success, failure, unresolved dependencies, original errors and checkpoints.

Common Issues

• Missing directory root or turtle: directory-level collection binding is incomplete.
• No complete block in the image range: retain the actual scan result without claiming whole-disk recoverability.
• Overwritten or trimmed blocks, or insufficient sources: current evidence does not prove that old values remain.