Recovering 220GB of files in a formatted partition with TestdiskHow do I recover my accidentally lost Windows partitions after installing Ubuntu?need to recover data from a data hard disk that I used testdisk on in my attempt to repair mbr from a rootkit virusRecovering deleted ext4 Ubuntu partitions using TestDisk (None partition media table type)How do I use testdisk?recover data on external driveProblem in recovering with Linux, testdiskFormatted Windows 10 partition by mistake while installing Ubuntu. How can I recover it?Recovering a lost file with testdiskrecovering lost data after installing ubuntu on windows 10 using testdiskRecovering thunderbird files from quick formatted drive?Can I recover Windows files from a dual-boot (Ubuntu 16.04 and Windows 10) overwritten by Ubuntu?Accidentally formatted my HDD when attempting to reinstall Ubuntu
Gantt Chart like rectangles with log scale
Use of undefined constant bloginfo
It's a yearly task, alright
Do I need to be arrogant to get ahead?
Why does Bach not break the rules here?
What are substitutions for coconut in curry?
Is it normal that my co-workers at a fitness company criticize my food choices?
Life insurance that covers only simultaneous/dual deaths
What is the significance behind "40 days" that often appears in the Bible?
Have researchers managed to "reverse time"? If so, what does that mean for physics?
What did Alexander Pope mean by "Expletives their feeble Aid do join"?
If I can solve Sudoku can I solve Travelling Salesman Problem(TSP)? If yes, how?
How to simplify this time periods definition interface?
Are all passive ability checks floors for active ability checks?
What approach do we need to follow for projects without a test environment?
Does someone need to be connected to my network to sniff HTTP requests?
Unexpected result from ArcLength
What do Xenomorphs eat in the Alien series?
Could the Saturn V actually have launched astronauts around Venus?
Why did it take so long to abandon sail after steamships were demonstrated?
How do anti-virus programs start at Windows boot?
How Could an Airship Be Repaired Mid-Flight
What is the domain in a tikz parametric plot?
How to make healing in an exploration game interesting
Recovering 220GB of files in a formatted partition with Testdisk
How do I recover my accidentally lost Windows partitions after installing Ubuntu?need to recover data from a data hard disk that I used testdisk on in my attempt to repair mbr from a rootkit virusRecovering deleted ext4 Ubuntu partitions using TestDisk (None partition media table type)How do I use testdisk?recover data on external driveProblem in recovering with Linux, testdiskFormatted Windows 10 partition by mistake while installing Ubuntu. How can I recover it?Recovering a lost file with testdiskrecovering lost data after installing ubuntu on windows 10 using testdiskRecovering thunderbird files from quick formatted drive?Can I recover Windows files from a dual-boot (Ubuntu 16.04 and Windows 10) overwritten by Ubuntu?Accidentally formatted my HDD when attempting to reinstall Ubuntu
I went away from the Linux world for a decade or so. Now that I'm trying my way back, that nice little warning that told me that I would lost all my files when replacing Windows XP failed to be clear in that it would not only replace the partition where my old windows was (10 GB), but also any and all other partitions of the same hard disk (my 200 and some GB collection made from pure MP3 and JPG files). This is so not cool for a migration that had to run smooth.
So I tooked the 250 GB HD and placed on a PC with Ubuntu 14, installed TestDisk, went to all the Deep Search process, and got into a NTFS file system with only like 1% of the files in it (well, all of the files of that sole folder). There was none of my other 99 folders on it (number aproximated).
I really need a hand with this. It's not like anything has overwritten those files, and I would understand that some 10GB of data is lost. But 90% of it, from one simple formatting and repartitioning process? Really?
windows data-recovery ntfs windows-xp testdisk
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
bumped to the homepage by Community♦ 21 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
I went away from the Linux world for a decade or so. Now that I'm trying my way back, that nice little warning that told me that I would lost all my files when replacing Windows XP failed to be clear in that it would not only replace the partition where my old windows was (10 GB), but also any and all other partitions of the same hard disk (my 200 and some GB collection made from pure MP3 and JPG files). This is so not cool for a migration that had to run smooth.
So I tooked the 250 GB HD and placed on a PC with Ubuntu 14, installed TestDisk, went to all the Deep Search process, and got into a NTFS file system with only like 1% of the files in it (well, all of the files of that sole folder). There was none of my other 99 folders on it (number aproximated).
I really need a hand with this. It's not like anything has overwritten those files, and I would understand that some 10GB of data is lost. But 90% of it, from one simple formatting and repartitioning process? Really?
windows data-recovery ntfs windows-xp testdisk
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
bumped to the homepage by Community♦ 21 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
I went away from the Linux world for a decade or so. Now that I'm trying my way back, that nice little warning that told me that I would lost all my files when replacing Windows XP failed to be clear in that it would not only replace the partition where my old windows was (10 GB), but also any and all other partitions of the same hard disk (my 200 and some GB collection made from pure MP3 and JPG files). This is so not cool for a migration that had to run smooth.
So I tooked the 250 GB HD and placed on a PC with Ubuntu 14, installed TestDisk, went to all the Deep Search process, and got into a NTFS file system with only like 1% of the files in it (well, all of the files of that sole folder). There was none of my other 99 folders on it (number aproximated).
I really need a hand with this. It's not like anything has overwritten those files, and I would understand that some 10GB of data is lost. But 90% of it, from one simple formatting and repartitioning process? Really?
windows data-recovery ntfs windows-xp testdisk
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
I went away from the Linux world for a decade or so. Now that I'm trying my way back, that nice little warning that told me that I would lost all my files when replacing Windows XP failed to be clear in that it would not only replace the partition where my old windows was (10 GB), but also any and all other partitions of the same hard disk (my 200 and some GB collection made from pure MP3 and JPG files). This is so not cool for a migration that had to run smooth.
So I tooked the 250 GB HD and placed on a PC with Ubuntu 14, installed TestDisk, went to all the Deep Search process, and got into a NTFS file system with only like 1% of the files in it (well, all of the files of that sole folder). There was none of my other 99 folders on it (number aproximated).
I really need a hand with this. It's not like anything has overwritten those files, and I would understand that some 10GB of data is lost. But 90% of it, from one simple formatting and repartitioning process? Really?
windows data-recovery ntfs windows-xp testdisk
windows data-recovery ntfs windows-xp testdisk
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
asked Nov 5 '14 at 22:40
Hermes VillafuerteHermes Villafuerte
112
112
bumped to the homepage by Community♦ 21 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 21 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
I had a damaged hard drive that was not readable via a file system some time ago and was able to recover that data that was not already corrupted by using ddrescue utility. I used an external hard drive that was empty and had a larger capacity than the hard drive that I wanted to copy. I then installed ddrescue to my ix system and ran a script that copied the entire contents of one drive to the external. it took a VERY long time, but it accomplished what i intended and was able to recover what i could from the corrupted drive.
Please be advised that ddrescue may irreversibly wipe the contents of your drive so be very careful and FOLLOW instructions carefully. I created a bootable usb with ubuntu rescue mix and made sre that ddrescue was installed on it... if not install it from the repos then I followed the instructions on the main ddrescue gnu page...
http://www.gnu.org/software/ddrescue/
---hope this helps
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
side notes: 1) the corrupted drive was ntfs - i was able to have the output of the ddrescue format to ntfs/fat 2) the original corrupted drive is still in the same condition it was before i ran ddrescue
– gingamann
Nov 5 '14 at 23:26
Thank you gingamann, I'll try that. Just to be sure, ¿Did it recover your files with names, timestamp and filestructure? Sinces there are a lot of songs I use for a Jukebox, it's pointless to use something that cannot recover the names of the files since I would have to open every song and rename it, and that will take a longer time than just recover them with such utility.
– Hermes Villafuerte
Nov 6 '14 at 12:18
So I have done a backup of 'hdb1'. But I think this is not the entire drive (which I beleive would be 'hdb'), since I have hdb2 and hdb3 of the new Ubuntu file table. Now I'm using Sleuthkit, but when mounting the image with $ mmls file -b I get the 'unknown argument error' followed by a message that I require tu use the -b argument XD. Well, I guess it is because the sintaxis is now 'mmls -b file', bu then I get an error of sector size (must be positive). I suppose I should tell it the sector size XD like 512 or something
– Hermes Villafuerte
Nov 7 '14 at 20:12
I'm just guessing that this command was wrong sudo ddrescue --no-split /dev/sdb1 /media/user1/3C9FD1452BA6CC99/rescatepol logfile and that I have to restart everthing with something like sudo ddrescue -n --force /dev/sdb /dev/sdh rescue.log in order to get the entire drive imaged. I only hope.
– Hermes Villafuerte
Nov 7 '14 at 21:05
I'll just keep describing in case someone with a similar problem make it here. It tunrs out that I was right about being wrong. The previous commands only created a backup of one current partition of the formatted drive, so I followed the instructions here derflounder.wordpress.com/2012/01/31/… to backup the entire disk. Syntaxis is important you know. Now I can't mount that image so I'll get my hands on that issue, since it is apparent that I have to restore the old partition table to recover my files, or use backup to scan file by file (dont know)
– Hermes Villafuerte
Nov 8 '14 at 18:23
|
show 11 more comments
you can try this - anytime i work with datarecovery I prefer to work with it externally - though this will increase the processing time spent working with it - i find it a more logical approach - use a usb thumb with bootable image for say.. ubuntu rescue mix as an example.. regardless how you want to approach it..
execute: sudo apt-get install ntfs-3g
though, this is probably already installed.
1) unmount said partition to carve
Execute: sudo umount /dev/sdwhatever
2) I'd create a list of all deleted files that this tool can find that are recoverable (the -p 100 tag defines 100% recoverable - leave it out of you want)
Execute: sudo ntfsundelete /dev/sdwhatever -m '*.mp3' -p 100 > deletedmusicwhatever.txt
3) review the list - the directory you are in when the command is executed is where the text file will be created ~/home/deletedmusicwhatever.txt - I dont know off the top of my head if something like: '*.wav''*.mp4''*.mp3' to search for multiple files types at once will work. May be a better idea to work with one at a time...
4) provided there are recoverable files that meet expectations then copy the files to an external drive
Execute: sudo ntfsundelete /dev/sdwhatever -u -m '*.mp3' -p 100 -d /media/nameofexternaldrive/recoveredmusicfolder
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
I'm afraid ntfsundelete wants the file system to be already NTFS, but it is obviously formatted with Ubuntu. I imagine TestDisk could somehow restore it, even if the image has no info, or the hard disk has only one folder. Maybe that way it would work?
– Hermes Villafuerte
Nov 11 '14 at 19:01
Yea.. testdisk is going to be your best bet.. I found this article illustrating the process in more detail. (askubuntu.com/questions/286181/…) - if this helps the poster: Takkat for the excellent detailed walk through
– gingamann
Nov 13 '14 at 1:07
Thanks gingamann, still trying to figure out if writing the ntfs partition table using only the image would result equally good than if writing it directly to the formatted drive.
– Hermes Villafuerte
Dec 1 '14 at 15:35
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f546146%2frecovering-220gb-of-files-in-a-formatted-partition-with-testdisk%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
I had a damaged hard drive that was not readable via a file system some time ago and was able to recover that data that was not already corrupted by using ddrescue utility. I used an external hard drive that was empty and had a larger capacity than the hard drive that I wanted to copy. I then installed ddrescue to my ix system and ran a script that copied the entire contents of one drive to the external. it took a VERY long time, but it accomplished what i intended and was able to recover what i could from the corrupted drive.
Please be advised that ddrescue may irreversibly wipe the contents of your drive so be very careful and FOLLOW instructions carefully. I created a bootable usb with ubuntu rescue mix and made sre that ddrescue was installed on it... if not install it from the repos then I followed the instructions on the main ddrescue gnu page...
http://www.gnu.org/software/ddrescue/
---hope this helps
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
side notes: 1) the corrupted drive was ntfs - i was able to have the output of the ddrescue format to ntfs/fat 2) the original corrupted drive is still in the same condition it was before i ran ddrescue
– gingamann
Nov 5 '14 at 23:26
Thank you gingamann, I'll try that. Just to be sure, ¿Did it recover your files with names, timestamp and filestructure? Sinces there are a lot of songs I use for a Jukebox, it's pointless to use something that cannot recover the names of the files since I would have to open every song and rename it, and that will take a longer time than just recover them with such utility.
– Hermes Villafuerte
Nov 6 '14 at 12:18
So I have done a backup of 'hdb1'. But I think this is not the entire drive (which I beleive would be 'hdb'), since I have hdb2 and hdb3 of the new Ubuntu file table. Now I'm using Sleuthkit, but when mounting the image with $ mmls file -b I get the 'unknown argument error' followed by a message that I require tu use the -b argument XD. Well, I guess it is because the sintaxis is now 'mmls -b file', bu then I get an error of sector size (must be positive). I suppose I should tell it the sector size XD like 512 or something
– Hermes Villafuerte
Nov 7 '14 at 20:12
I'm just guessing that this command was wrong sudo ddrescue --no-split /dev/sdb1 /media/user1/3C9FD1452BA6CC99/rescatepol logfile and that I have to restart everthing with something like sudo ddrescue -n --force /dev/sdb /dev/sdh rescue.log in order to get the entire drive imaged. I only hope.
– Hermes Villafuerte
Nov 7 '14 at 21:05
I'll just keep describing in case someone with a similar problem make it here. It tunrs out that I was right about being wrong. The previous commands only created a backup of one current partition of the formatted drive, so I followed the instructions here derflounder.wordpress.com/2012/01/31/… to backup the entire disk. Syntaxis is important you know. Now I can't mount that image so I'll get my hands on that issue, since it is apparent that I have to restore the old partition table to recover my files, or use backup to scan file by file (dont know)
– Hermes Villafuerte
Nov 8 '14 at 18:23
|
show 11 more comments
I had a damaged hard drive that was not readable via a file system some time ago and was able to recover that data that was not already corrupted by using ddrescue utility. I used an external hard drive that was empty and had a larger capacity than the hard drive that I wanted to copy. I then installed ddrescue to my ix system and ran a script that copied the entire contents of one drive to the external. it took a VERY long time, but it accomplished what i intended and was able to recover what i could from the corrupted drive.
Please be advised that ddrescue may irreversibly wipe the contents of your drive so be very careful and FOLLOW instructions carefully. I created a bootable usb with ubuntu rescue mix and made sre that ddrescue was installed on it... if not install it from the repos then I followed the instructions on the main ddrescue gnu page...
http://www.gnu.org/software/ddrescue/
---hope this helps
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
side notes: 1) the corrupted drive was ntfs - i was able to have the output of the ddrescue format to ntfs/fat 2) the original corrupted drive is still in the same condition it was before i ran ddrescue
– gingamann
Nov 5 '14 at 23:26
Thank you gingamann, I'll try that. Just to be sure, ¿Did it recover your files with names, timestamp and filestructure? Sinces there are a lot of songs I use for a Jukebox, it's pointless to use something that cannot recover the names of the files since I would have to open every song and rename it, and that will take a longer time than just recover them with such utility.
– Hermes Villafuerte
Nov 6 '14 at 12:18
So I have done a backup of 'hdb1'. But I think this is not the entire drive (which I beleive would be 'hdb'), since I have hdb2 and hdb3 of the new Ubuntu file table. Now I'm using Sleuthkit, but when mounting the image with $ mmls file -b I get the 'unknown argument error' followed by a message that I require tu use the -b argument XD. Well, I guess it is because the sintaxis is now 'mmls -b file', bu then I get an error of sector size (must be positive). I suppose I should tell it the sector size XD like 512 or something
– Hermes Villafuerte
Nov 7 '14 at 20:12
I'm just guessing that this command was wrong sudo ddrescue --no-split /dev/sdb1 /media/user1/3C9FD1452BA6CC99/rescatepol logfile and that I have to restart everthing with something like sudo ddrescue -n --force /dev/sdb /dev/sdh rescue.log in order to get the entire drive imaged. I only hope.
– Hermes Villafuerte
Nov 7 '14 at 21:05
I'll just keep describing in case someone with a similar problem make it here. It tunrs out that I was right about being wrong. The previous commands only created a backup of one current partition of the formatted drive, so I followed the instructions here derflounder.wordpress.com/2012/01/31/… to backup the entire disk. Syntaxis is important you know. Now I can't mount that image so I'll get my hands on that issue, since it is apparent that I have to restore the old partition table to recover my files, or use backup to scan file by file (dont know)
– Hermes Villafuerte
Nov 8 '14 at 18:23
|
show 11 more comments
I had a damaged hard drive that was not readable via a file system some time ago and was able to recover that data that was not already corrupted by using ddrescue utility. I used an external hard drive that was empty and had a larger capacity than the hard drive that I wanted to copy. I then installed ddrescue to my ix system and ran a script that copied the entire contents of one drive to the external. it took a VERY long time, but it accomplished what i intended and was able to recover what i could from the corrupted drive.
Please be advised that ddrescue may irreversibly wipe the contents of your drive so be very careful and FOLLOW instructions carefully. I created a bootable usb with ubuntu rescue mix and made sre that ddrescue was installed on it... if not install it from the repos then I followed the instructions on the main ddrescue gnu page...
http://www.gnu.org/software/ddrescue/
---hope this helps
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
I had a damaged hard drive that was not readable via a file system some time ago and was able to recover that data that was not already corrupted by using ddrescue utility. I used an external hard drive that was empty and had a larger capacity than the hard drive that I wanted to copy. I then installed ddrescue to my ix system and ran a script that copied the entire contents of one drive to the external. it took a VERY long time, but it accomplished what i intended and was able to recover what i could from the corrupted drive.
Please be advised that ddrescue may irreversibly wipe the contents of your drive so be very careful and FOLLOW instructions carefully. I created a bootable usb with ubuntu rescue mix and made sre that ddrescue was installed on it... if not install it from the repos then I followed the instructions on the main ddrescue gnu page...
http://www.gnu.org/software/ddrescue/
---hope this helps
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
answered Nov 5 '14 at 22:45
gingamanngingamann
283413
283413
side notes: 1) the corrupted drive was ntfs - i was able to have the output of the ddrescue format to ntfs/fat 2) the original corrupted drive is still in the same condition it was before i ran ddrescue
– gingamann
Nov 5 '14 at 23:26
Thank you gingamann, I'll try that. Just to be sure, ¿Did it recover your files with names, timestamp and filestructure? Sinces there are a lot of songs I use for a Jukebox, it's pointless to use something that cannot recover the names of the files since I would have to open every song and rename it, and that will take a longer time than just recover them with such utility.
– Hermes Villafuerte
Nov 6 '14 at 12:18
So I have done a backup of 'hdb1'. But I think this is not the entire drive (which I beleive would be 'hdb'), since I have hdb2 and hdb3 of the new Ubuntu file table. Now I'm using Sleuthkit, but when mounting the image with $ mmls file -b I get the 'unknown argument error' followed by a message that I require tu use the -b argument XD. Well, I guess it is because the sintaxis is now 'mmls -b file', bu then I get an error of sector size (must be positive). I suppose I should tell it the sector size XD like 512 or something
– Hermes Villafuerte
Nov 7 '14 at 20:12
I'm just guessing that this command was wrong sudo ddrescue --no-split /dev/sdb1 /media/user1/3C9FD1452BA6CC99/rescatepol logfile and that I have to restart everthing with something like sudo ddrescue -n --force /dev/sdb /dev/sdh rescue.log in order to get the entire drive imaged. I only hope.
– Hermes Villafuerte
Nov 7 '14 at 21:05
I'll just keep describing in case someone with a similar problem make it here. It tunrs out that I was right about being wrong. The previous commands only created a backup of one current partition of the formatted drive, so I followed the instructions here derflounder.wordpress.com/2012/01/31/… to backup the entire disk. Syntaxis is important you know. Now I can't mount that image so I'll get my hands on that issue, since it is apparent that I have to restore the old partition table to recover my files, or use backup to scan file by file (dont know)
– Hermes Villafuerte
Nov 8 '14 at 18:23
|
show 11 more comments
side notes: 1) the corrupted drive was ntfs - i was able to have the output of the ddrescue format to ntfs/fat 2) the original corrupted drive is still in the same condition it was before i ran ddrescue
– gingamann
Nov 5 '14 at 23:26
Thank you gingamann, I'll try that. Just to be sure, ¿Did it recover your files with names, timestamp and filestructure? Sinces there are a lot of songs I use for a Jukebox, it's pointless to use something that cannot recover the names of the files since I would have to open every song and rename it, and that will take a longer time than just recover them with such utility.
– Hermes Villafuerte
Nov 6 '14 at 12:18
So I have done a backup of 'hdb1'. But I think this is not the entire drive (which I beleive would be 'hdb'), since I have hdb2 and hdb3 of the new Ubuntu file table. Now I'm using Sleuthkit, but when mounting the image with $ mmls file -b I get the 'unknown argument error' followed by a message that I require tu use the -b argument XD. Well, I guess it is because the sintaxis is now 'mmls -b file', bu then I get an error of sector size (must be positive). I suppose I should tell it the sector size XD like 512 or something
– Hermes Villafuerte
Nov 7 '14 at 20:12
I'm just guessing that this command was wrong sudo ddrescue --no-split /dev/sdb1 /media/user1/3C9FD1452BA6CC99/rescatepol logfile and that I have to restart everthing with something like sudo ddrescue -n --force /dev/sdb /dev/sdh rescue.log in order to get the entire drive imaged. I only hope.
– Hermes Villafuerte
Nov 7 '14 at 21:05
I'll just keep describing in case someone with a similar problem make it here. It tunrs out that I was right about being wrong. The previous commands only created a backup of one current partition of the formatted drive, so I followed the instructions here derflounder.wordpress.com/2012/01/31/… to backup the entire disk. Syntaxis is important you know. Now I can't mount that image so I'll get my hands on that issue, since it is apparent that I have to restore the old partition table to recover my files, or use backup to scan file by file (dont know)
– Hermes Villafuerte
Nov 8 '14 at 18:23
side notes: 1) the corrupted drive was ntfs - i was able to have the output of the ddrescue format to ntfs/fat 2) the original corrupted drive is still in the same condition it was before i ran ddrescue
– gingamann
Nov 5 '14 at 23:26
side notes: 1) the corrupted drive was ntfs - i was able to have the output of the ddrescue format to ntfs/fat 2) the original corrupted drive is still in the same condition it was before i ran ddrescue
– gingamann
Nov 5 '14 at 23:26
Thank you gingamann, I'll try that. Just to be sure, ¿Did it recover your files with names, timestamp and filestructure? Sinces there are a lot of songs I use for a Jukebox, it's pointless to use something that cannot recover the names of the files since I would have to open every song and rename it, and that will take a longer time than just recover them with such utility.
– Hermes Villafuerte
Nov 6 '14 at 12:18
Thank you gingamann, I'll try that. Just to be sure, ¿Did it recover your files with names, timestamp and filestructure? Sinces there are a lot of songs I use for a Jukebox, it's pointless to use something that cannot recover the names of the files since I would have to open every song and rename it, and that will take a longer time than just recover them with such utility.
– Hermes Villafuerte
Nov 6 '14 at 12:18
So I have done a backup of 'hdb1'. But I think this is not the entire drive (which I beleive would be 'hdb'), since I have hdb2 and hdb3 of the new Ubuntu file table. Now I'm using Sleuthkit, but when mounting the image with $ mmls file -b I get the 'unknown argument error' followed by a message that I require tu use the -b argument XD. Well, I guess it is because the sintaxis is now 'mmls -b file', bu then I get an error of sector size (must be positive). I suppose I should tell it the sector size XD like 512 or something
– Hermes Villafuerte
Nov 7 '14 at 20:12
So I have done a backup of 'hdb1'. But I think this is not the entire drive (which I beleive would be 'hdb'), since I have hdb2 and hdb3 of the new Ubuntu file table. Now I'm using Sleuthkit, but when mounting the image with $ mmls file -b I get the 'unknown argument error' followed by a message that I require tu use the -b argument XD. Well, I guess it is because the sintaxis is now 'mmls -b file', bu then I get an error of sector size (must be positive). I suppose I should tell it the sector size XD like 512 or something
– Hermes Villafuerte
Nov 7 '14 at 20:12
I'm just guessing that this command was wrong sudo ddrescue --no-split /dev/sdb1 /media/user1/3C9FD1452BA6CC99/rescatepol logfile and that I have to restart everthing with something like sudo ddrescue -n --force /dev/sdb /dev/sdh rescue.log in order to get the entire drive imaged. I only hope.
– Hermes Villafuerte
Nov 7 '14 at 21:05
I'm just guessing that this command was wrong sudo ddrescue --no-split /dev/sdb1 /media/user1/3C9FD1452BA6CC99/rescatepol logfile and that I have to restart everthing with something like sudo ddrescue -n --force /dev/sdb /dev/sdh rescue.log in order to get the entire drive imaged. I only hope.
– Hermes Villafuerte
Nov 7 '14 at 21:05
I'll just keep describing in case someone with a similar problem make it here. It tunrs out that I was right about being wrong. The previous commands only created a backup of one current partition of the formatted drive, so I followed the instructions here derflounder.wordpress.com/2012/01/31/… to backup the entire disk. Syntaxis is important you know. Now I can't mount that image so I'll get my hands on that issue, since it is apparent that I have to restore the old partition table to recover my files, or use backup to scan file by file (dont know)
– Hermes Villafuerte
Nov 8 '14 at 18:23
I'll just keep describing in case someone with a similar problem make it here. It tunrs out that I was right about being wrong. The previous commands only created a backup of one current partition of the formatted drive, so I followed the instructions here derflounder.wordpress.com/2012/01/31/… to backup the entire disk. Syntaxis is important you know. Now I can't mount that image so I'll get my hands on that issue, since it is apparent that I have to restore the old partition table to recover my files, or use backup to scan file by file (dont know)
– Hermes Villafuerte
Nov 8 '14 at 18:23
|
show 11 more comments
you can try this - anytime i work with datarecovery I prefer to work with it externally - though this will increase the processing time spent working with it - i find it a more logical approach - use a usb thumb with bootable image for say.. ubuntu rescue mix as an example.. regardless how you want to approach it..
execute: sudo apt-get install ntfs-3g
though, this is probably already installed.
1) unmount said partition to carve
Execute: sudo umount /dev/sdwhatever
2) I'd create a list of all deleted files that this tool can find that are recoverable (the -p 100 tag defines 100% recoverable - leave it out of you want)
Execute: sudo ntfsundelete /dev/sdwhatever -m '*.mp3' -p 100 > deletedmusicwhatever.txt
3) review the list - the directory you are in when the command is executed is where the text file will be created ~/home/deletedmusicwhatever.txt - I dont know off the top of my head if something like: '*.wav''*.mp4''*.mp3' to search for multiple files types at once will work. May be a better idea to work with one at a time...
4) provided there are recoverable files that meet expectations then copy the files to an external drive
Execute: sudo ntfsundelete /dev/sdwhatever -u -m '*.mp3' -p 100 -d /media/nameofexternaldrive/recoveredmusicfolder
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
I'm afraid ntfsundelete wants the file system to be already NTFS, but it is obviously formatted with Ubuntu. I imagine TestDisk could somehow restore it, even if the image has no info, or the hard disk has only one folder. Maybe that way it would work?
– Hermes Villafuerte
Nov 11 '14 at 19:01
Yea.. testdisk is going to be your best bet.. I found this article illustrating the process in more detail. (askubuntu.com/questions/286181/…) - if this helps the poster: Takkat for the excellent detailed walk through
– gingamann
Nov 13 '14 at 1:07
Thanks gingamann, still trying to figure out if writing the ntfs partition table using only the image would result equally good than if writing it directly to the formatted drive.
– Hermes Villafuerte
Dec 1 '14 at 15:35
add a comment |
you can try this - anytime i work with datarecovery I prefer to work with it externally - though this will increase the processing time spent working with it - i find it a more logical approach - use a usb thumb with bootable image for say.. ubuntu rescue mix as an example.. regardless how you want to approach it..
execute: sudo apt-get install ntfs-3g
though, this is probably already installed.
1) unmount said partition to carve
Execute: sudo umount /dev/sdwhatever
2) I'd create a list of all deleted files that this tool can find that are recoverable (the -p 100 tag defines 100% recoverable - leave it out of you want)
Execute: sudo ntfsundelete /dev/sdwhatever -m '*.mp3' -p 100 > deletedmusicwhatever.txt
3) review the list - the directory you are in when the command is executed is where the text file will be created ~/home/deletedmusicwhatever.txt - I dont know off the top of my head if something like: '*.wav''*.mp4''*.mp3' to search for multiple files types at once will work. May be a better idea to work with one at a time...
4) provided there are recoverable files that meet expectations then copy the files to an external drive
Execute: sudo ntfsundelete /dev/sdwhatever -u -m '*.mp3' -p 100 -d /media/nameofexternaldrive/recoveredmusicfolder
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
I'm afraid ntfsundelete wants the file system to be already NTFS, but it is obviously formatted with Ubuntu. I imagine TestDisk could somehow restore it, even if the image has no info, or the hard disk has only one folder. Maybe that way it would work?
– Hermes Villafuerte
Nov 11 '14 at 19:01
Yea.. testdisk is going to be your best bet.. I found this article illustrating the process in more detail. (askubuntu.com/questions/286181/…) - if this helps the poster: Takkat for the excellent detailed walk through
– gingamann
Nov 13 '14 at 1:07
Thanks gingamann, still trying to figure out if writing the ntfs partition table using only the image would result equally good than if writing it directly to the formatted drive.
– Hermes Villafuerte
Dec 1 '14 at 15:35
add a comment |
you can try this - anytime i work with datarecovery I prefer to work with it externally - though this will increase the processing time spent working with it - i find it a more logical approach - use a usb thumb with bootable image for say.. ubuntu rescue mix as an example.. regardless how you want to approach it..
execute: sudo apt-get install ntfs-3g
though, this is probably already installed.
1) unmount said partition to carve
Execute: sudo umount /dev/sdwhatever
2) I'd create a list of all deleted files that this tool can find that are recoverable (the -p 100 tag defines 100% recoverable - leave it out of you want)
Execute: sudo ntfsundelete /dev/sdwhatever -m '*.mp3' -p 100 > deletedmusicwhatever.txt
3) review the list - the directory you are in when the command is executed is where the text file will be created ~/home/deletedmusicwhatever.txt - I dont know off the top of my head if something like: '*.wav''*.mp4''*.mp3' to search for multiple files types at once will work. May be a better idea to work with one at a time...
4) provided there are recoverable files that meet expectations then copy the files to an external drive
Execute: sudo ntfsundelete /dev/sdwhatever -u -m '*.mp3' -p 100 -d /media/nameofexternaldrive/recoveredmusicfolder
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
you can try this - anytime i work with datarecovery I prefer to work with it externally - though this will increase the processing time spent working with it - i find it a more logical approach - use a usb thumb with bootable image for say.. ubuntu rescue mix as an example.. regardless how you want to approach it..
execute: sudo apt-get install ntfs-3g
though, this is probably already installed.
1) unmount said partition to carve
Execute: sudo umount /dev/sdwhatever
2) I'd create a list of all deleted files that this tool can find that are recoverable (the -p 100 tag defines 100% recoverable - leave it out of you want)
Execute: sudo ntfsundelete /dev/sdwhatever -m '*.mp3' -p 100 > deletedmusicwhatever.txt
3) review the list - the directory you are in when the command is executed is where the text file will be created ~/home/deletedmusicwhatever.txt - I dont know off the top of my head if something like: '*.wav''*.mp4''*.mp3' to search for multiple files types at once will work. May be a better idea to work with one at a time...
4) provided there are recoverable files that meet expectations then copy the files to an external drive
Execute: sudo ntfsundelete /dev/sdwhatever -u -m '*.mp3' -p 100 -d /media/nameofexternaldrive/recoveredmusicfolder
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
answered Nov 9 '14 at 2:06
gingamanngingamann
283413
283413
I'm afraid ntfsundelete wants the file system to be already NTFS, but it is obviously formatted with Ubuntu. I imagine TestDisk could somehow restore it, even if the image has no info, or the hard disk has only one folder. Maybe that way it would work?
– Hermes Villafuerte
Nov 11 '14 at 19:01
Yea.. testdisk is going to be your best bet.. I found this article illustrating the process in more detail. (askubuntu.com/questions/286181/…) - if this helps the poster: Takkat for the excellent detailed walk through
– gingamann
Nov 13 '14 at 1:07
Thanks gingamann, still trying to figure out if writing the ntfs partition table using only the image would result equally good than if writing it directly to the formatted drive.
– Hermes Villafuerte
Dec 1 '14 at 15:35
add a comment |
I'm afraid ntfsundelete wants the file system to be already NTFS, but it is obviously formatted with Ubuntu. I imagine TestDisk could somehow restore it, even if the image has no info, or the hard disk has only one folder. Maybe that way it would work?
– Hermes Villafuerte
Nov 11 '14 at 19:01
Yea.. testdisk is going to be your best bet.. I found this article illustrating the process in more detail. (askubuntu.com/questions/286181/…) - if this helps the poster: Takkat for the excellent detailed walk through
– gingamann
Nov 13 '14 at 1:07
Thanks gingamann, still trying to figure out if writing the ntfs partition table using only the image would result equally good than if writing it directly to the formatted drive.
– Hermes Villafuerte
Dec 1 '14 at 15:35
I'm afraid ntfsundelete wants the file system to be already NTFS, but it is obviously formatted with Ubuntu. I imagine TestDisk could somehow restore it, even if the image has no info, or the hard disk has only one folder. Maybe that way it would work?
– Hermes Villafuerte
Nov 11 '14 at 19:01
I'm afraid ntfsundelete wants the file system to be already NTFS, but it is obviously formatted with Ubuntu. I imagine TestDisk could somehow restore it, even if the image has no info, or the hard disk has only one folder. Maybe that way it would work?
– Hermes Villafuerte
Nov 11 '14 at 19:01
Yea.. testdisk is going to be your best bet.. I found this article illustrating the process in more detail. (askubuntu.com/questions/286181/…) - if this helps the poster: Takkat for the excellent detailed walk through
– gingamann
Nov 13 '14 at 1:07
Yea.. testdisk is going to be your best bet.. I found this article illustrating the process in more detail. (askubuntu.com/questions/286181/…) - if this helps the poster: Takkat for the excellent detailed walk through
– gingamann
Nov 13 '14 at 1:07
Thanks gingamann, still trying to figure out if writing the ntfs partition table using only the image would result equally good than if writing it directly to the formatted drive.
– Hermes Villafuerte
Dec 1 '14 at 15:35
Thanks gingamann, still trying to figure out if writing the ntfs partition table using only the image would result equally good than if writing it directly to the formatted drive.
– Hermes Villafuerte
Dec 1 '14 at 15:35
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f546146%2frecovering-220gb-of-files-in-a-formatted-partition-with-testdisk%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
