YMMV, but this worked for me. Before the software update is installed on flash, it's stored on disk in MFS. Even with a lack of MFS tools, the SW update can be located using traditional data recovery techniques, bypassing the filesystem.
I don't know when it's deleted, but it would have to be on disk at least when "Pending Restart".
1) Get partition offsets, and isolate MFS app partition(s)
a) copy & paste the line with #10 MFS app region:
# losetup -f /dev/sdX --offset 180486095872 --sizelimit 838860800
or b) Use a Roamio aware linux kernel
or c) Use a Mac w/OS X
or d) tivopart
2) Grab, install, run photorec on MFS app partition(s)
3) Test integrity of all recovered gzip fragments.
# ls recup_dir*/*.gz | xargs -n1 zcat > /dev/null
You're looking for lines that look like:
gzip: recup_dir.2/f0998559.gz: decompression OK, trailing garbage ignored
4) Extract it
zcat recup_dir.2/f0998559.gz > f0998559.bin
5) Check file type
# file f0998559.bin
f0998559.bin: ASCII cpio archive (SVR4 with CRC)
f0998559.bin: Squashfs filesystem, little endian, version 4.0, 320783588 bytes...
The first example would be a kernel or root filesystem fragment when built piecemeal.
The second example would be a complete root filesystem image.
6a) If cpio, Extract
6b) If squashfs, Mount root filesystem and take a look around
# cpio ... f0998559.bin
# ls -la
-rw-r--r-- 1 root root 89 May 6 06:52 .jpminstall
-rw-r--r-- 1 root root 4537336 May 6 06:52 vmlinux.px
# mount -oro f0998559.bin /mnt/
# ls /mnt
bin db dist fuse install mnt platform product sys tvbin tvres var
cgroup dev etc initrd lib opt proc sbin tmp tvlib usr volatile
* More options:
PhotoRec exists for Win / Mac / Linux.
Whether the OS can get at the partition map will determine whether you have to scan MB's vs the whole drive.
** To run against MFS app 2, use partition #12 and