data recovery

English Applications
#1

Hi,

My daughter accidentally deleted pictures (folder) on her machine with ext4 file system, further destroyed partition table and formatted sdb to ntfs. How to recover the images?

Best,

Dave

#2

How to recover the images?

Sorry to say so: from the backup. I doubt that even a sophisticated forensic recovery tool could get your pictures back in this situation.

#3

Try PhotoRec program.
PhotoRec - CGSecurity

There is a package in Packman repository.

#4

I have tried photorec but it wont go beyond present disk geometry. I will like to find something that can actually show old partitions.

#5

Hi
Hopefully you have pulled the drive out of the system and aren’t using it until someone can help. I’m reluctant to offer any other suggestions :frowning:

#6

avenuemax wrote:

>
> Hi,
>
> My daughter accidentally deleted pictures (folder) on her machine with
> ext4 file system, further destroyed partition table and formatted sdb to
> ntfs. How to recover the images?
>
> Best,
>
> Dave
>
>
Sorry no chance, except you take the hard disk and send it to a professional
service (which will cost several thousand euros at least and there is no
guarantee that it will be possible).
You probably have copies on some media you forgot about, check if you
remember something (a usb, a cd)?

#7

avenuemax wrote:
> My daughter accidentally deleted pictures (folder) on her machine with
> ext4 file system, further destroyed partition table and formatted sdb to
> ntfs. How to recover the images?

several different/alternative ways:

  1. recover from the latest off-machine backup of that folder

  2. step-by-step:
    a. pull the power plug
    b. remove the drive
    c. take/mail it to a data recovery expert (many available on the web)
    d. take LOTS of money (but recovery is not guaranteed)

  3. try it yourself: http://tinyurl.com/2wa82gk

–
DenverD
CAVEAT: http://is.gd/bpoMD [posted via NNTP w/openSUSE 10.3]

#8

Daughter put in data and music already. Have not deleted anything.

#9

The more you write to the disk more of the old sectors that are used by the new data that may have the old data are overwritten. So the less chance to recover it.

  1. backup your data often
  2. As soon as you notice a loss or problem with the data STOP. Do no more with that drive or partition until you have recovered as much as possible. The more random things you try reduces the probability of recovery.
  3. always follow the 3 rules of computing. Backup,Backup,Backup.
#10

EnCase Forensics can recover everything no matter how many times the drive gets formatted or rewritten but that doesnt suport ext4 as yet. I need to find something that supports ext4.

#11

Its been written to, you can continue reading the PR spin but you’re reading about forensics not undeleting. J%st b?ca%se y!u can r£ad this doesn’t mean it has undeleted it but recovered enough context.

You may want to read more about recovery i.e from the cgsec wiki page on photorec

When a file is deleted, the meta-information about this file (file name, date/time, size, location of the first data block/cluster, etc.) is lost; e.g., in an ext3/ext4 file system, the names of deleted files are still present, but the location of the first data block is removed. This means the data is still present on the file system, but only until some or all of it is overwritten by new file data.

In case that little lot isn’t good enough how about the standards for most government and official bodies Data erasure - Wikipedia, the free encyclopedia then you’ll notice that bit-by-bit analysis by platter is feasible as for expense I bet $$$.

Any way your looking at it wrong unless I’m mistaken photorec cares nowt for the partition layout search the whole disk, testdisk recovers the partition, layout but to be honest I think your insistence on recovery of over written bits has damaged it beyond repair, unless as my example it is context you’re after rather than undelete.

And if Photorec isn’t good enough but as you said only images it should be fine then you have foremost but that is getting into datacarving at a low level.

Why does the Forensic wik talk so much about ro only why do all the forensic tools go into ro? Forensic Linux Live CD issues - Forensics Wiki This should be done on an image rather than the real disk either way. Without all the writes its had I would of suggested Extundelete but with all the writes I think it would be pointless.

#12

I wrote to Christophe (the guy who wrote photorec) and according to him recovery is possible. I will mirror the disk and try recovering that.

#13

I wish you luck having done my fair share of recovering photos but thankfully only undeleted.
Just bear in mind if the data was on 40gb and it now has 36gb of data you’ll only be able to recover from the 4gb and that will be excluding any temporary files that may have also written to it.

#14

Yeah, I am aware of it.

#15

I think you have few chance to recover from a hard disk.

You may go for an computer agent to see if they can try to recover the deleted pictures.

Try not to put new files to the folder that you have lost your photos since that will overwrite the old data.

Good luck!:slight_smile: