sudo mount -o loop,offset=$OFFSET xyz.db  /mnt

FYI, you need to replace $OFFSET with a number, but I don't see the numbers you need from the fdisk command to calculate the offset. (sector size X first sector)

It might be that, either instead or in addition to mounting it as fsmithred suggests, you need one of the tools listed here:
https://en.wikipedia.org/wiki/COM_Struc … mentations

Seems plausible that it's relating to Microsoft Teams crashing and writing everything in memory to disk, or something like that.

Another thing you could look for is if there are other files on disk with similar modification times. (Or if you still have any log files from back then, grep those to see if there's any relevant messages.)

For example, find can identify files modified within 5 minutes either side, like so:

find START_PATH -newermt '2020-07-06 17:21' -not -newermt '2020-07-06 17:31'

Replace START_PATH with a suitable directory, e.g. /home/user and maybe also try with switching -newermt to -newerct (or -newerat), as per -newerXY in find docs.

xyz.db: 4 GiB, 4294966784 bytes, 8388607 sectors

sudo mount -o loop,offset=$OFFSET xyz.db  /mnt
mount: bad usage
Try 'mount --help' for more information.

#Request patience

Maybe...
mount -o loop,offset=$OFFSET xyz.db /mnt

Are there other possibilities within Linux?
Sqlite3 just give cryptic characters ... as i mentioned above.

It might be that these are useless temp files, right.
But as it is named "recover" (i myself would not name a recover file "recover" but Sicherung or something like that) I suspect it might be something I should store.
It could be something from the time I ran "teams" on my machine for my sons home schooling period during corona-times.
("teams" did a lot of uncontrollable things and was not -as promised- running  within Firefox alone, crashed several times and was then removed, last time I ran one of Billy's products)
Thanks

Otherwise, putting "Composite Document File V2 Document" into a search engine reveals:

So it's Microsoft's version of a TAR file, and could potentially contain anything.

Briefly looking at other results suggest it may be meaningful data but might also just be a temp file.

"file xyz.db" results in:
"Composite Document File V2 Document, Cannot read section info"

"stat xyz" gives:
file: xyz.db
  size: 4294967295    blocks: 8388616    EA block: 4096   regular file
Device: 808h/2056d    Inode: 5510191     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access    : 2023-04-24 19:47:44.524001543 +0200
Modify: 2020-07-06 17:26:34.000000000 +0200
Change: 2021-03-04 22:45:42.316023800 +0100
Birth    : -

>what does `file xyz.db` say? creation date?

-rw-r--r-- 1 root root 4294967295 Jul  6  2020
(Can't remember what I could have done three years ago to create them)

If they've not been used in nearly 3 years, I'd just delete them - or copy/move them to external media, if you are unsure.

>what does `file xyz.db` say? creation date?

-rw-r--r-- 1 root root 4294967295 Jul  6  2020

Entering file xyz.db will not give that output!

It looks like ls -l output (with filename removed), and ls doesn't give a file's creation date - it gives mtime (modification) but can be requested to give atime (access) or ctime (file status change).

Running stat xyz.db will give all three times precisely - along with a value for file creation called "birth" if the filesystem supports it - likely mtime and ctime are the same, but if they differ then this may indicate if/when the file was copied to that system from elsewhere.

-rw-r--r-- 1 root root 4294967295 Jul  6  2020
(Can't remember what I could have done three years ago to create them)

>could be a db backup, or something else. do you have a database server running on that system?

No, just a normal pc, no database server (as far as I know)
[UPDATE] I tried to open one of the files using sqlite3. But no hint about the content, only a long row of
-- unrecognized token " "
-- syntax error
-- and unreadable characters
runs about 15 minutes

LibreOffice doesn't know to open it (or better said I don't know how to make LibreOffice open it)

could be a db backup, or something else. do you have a database server running on that system?

I found 5 files, each 4 GB, named like "xyz.db" in a directory named "recover".

Has anyone an idea where this might come from? Can't remember that I did that (so not a 100% proof)
;-)

Anyway 20 GB is a lot of wood, just delete them, seems a bit risky to me.

Any hints?
Thanks