Testdisk - Is there order in this chaos?

English Applications
1

Calling all data recovery specialists,

Two days ago I broke one of my own rules. “Think before you click”. The result is that I now accidentally partly formatted my openSUSE 12.2 hard drive >:(

I have not lost anything critical, thankfully, but I would now like to see if I can do a recovery using testdisk and photorec. I let photorec rip on the drive and 12 hours later I had several thousand files. This leads me to belief that at least part of the drive is fine. I formatted the drive from Windows and it had not even shown up as 1% complete when I realised my mistake and stopped the process.

I then tried testdisk. A normal search did not find what I wanted but a deep search brought up to much! I think, I am not near the pc at the moment, it found about 12 different things. The disk has a long history so I presume it’s most of my previous installations it’s finding.

Is there any order in which it displays these findings?

I will post a screen shot when I am back home but I am a little lost. How do I know which one is the latest?

2

On 2012-12-24 14:06, Dexter1979 wrote:

> I have not lost anything critical, thankfully, but I would now like to
> see if I can do a recovery using testdisk and photorec.

The important thing is not to touch the disk, ie, all writes should go
to a different disk. If possible, make an image of the entire partition
before starting…

Photorec is good at recovering multimedia files, but not much more, IMHO.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

3

According to the live-usb disk I’m running it had no partitions… I’d say the partition table got destroyed… But the physical files are still there…

Yeah, that and the fact that it dumps the data without file names… So I will have to filter them out manually…

Have you any experience with testdisk successfully recovering a partition from this? Or should I just filter my files (mp3’s, movies, pictures, documents) and count myself lucky that I got that much back?

4

On 2012-12-24 15:26, Dexter1979 wrote:

> Have you any experience with testdisk successfully recovering a
> partition from this? Or should I just filter my files (mp3’s, movies,
> pictures, documents) and count myself lucky that I got that much back?

I have used it several times, and I was never fully happy. Count your
blessings… If it works, it is better than photorec, you get names and
structure. It is possible, IIRC, to make an image of the damaged disk
and work on the image leaving the original intact. Thus you can try one
of the recovery proposals, and if that turns out no good, try another on
a new image. You can try as many times you need/want - but of course,
you need one disk or partition bigger than the original to make the
image (and free space somewhere else to copy the results).

Once I used commercial software to recover an NTFS partition that had
lost the MFT table. I used this:

http://www.restorer-ultimate.com/download.shtml

and the result was quite good. I don’t remember if they work on Linux
filesystem, but you need a running Windows (or a virtualized one if you
plug the disk via USB). I got the recomendation on the tesdisk site, no
less… (it mentioned “Zero Assumption Recovery, GetDataBack for NTFS or
Restorer 2000”).

It might be worth a shot investigating.

It is commercial software with good commercial sense. I mean, they know
you doubt their claims, so they allow you to run the program in “demo”
mode searching your disk. It will only recover small files (125KB), but
it lists all it might recover, to wet your appetite, lets say. So that
if after having it running for 5 hours you want to buy, you just do that
without closing the program, enter the code, and it switches to real
mode with the 5 hours work done already…

I’m just telling you the possibilities, not everything out there is
always free software. :slight_smile:

–
Cheers / Saludos,
u
Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

5

Thanks for your suggestions, Carlos…

Here is a update of the situation… After I was satisfied that all my files were recovered with photorec I let testdisk loose on the drive… After a deep search I went through the list and picked the second last one it found. I looked at the structure and tried to mark my 3 linux partitions. It didn’t like this. Picking any of the 3 was fine. So I decided to pick what I thought was my home partition and told it to write it to the disk. After a reboot the Linux Mint live-usb could access my filed no problem… I copied these to a external hard drive, reinstalled 12.2 and then copied my files back… result is I am now back without loosing anything as far as I can tell!!

Lucky escape!

6

On 2012-12-25 21:46, Dexter1979 wrote:
> reinstalled 12.2 and then copied my files back… result is I am now back
> without loosing anything as far as I can tell!!
>
> Lucky escape!

Indeed! :slight_smile:

(get a backup done for the next time something happens :wink: )

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

7

Already done :slight_smile:

8

FYI - Not that long ago I experienced the same issue, somehow I inadvertently broke/removed the partition boundaries while leaving the data intact.

I found and ran photorec from the openSUSE repos which quickly found and fixed the problem within seconds. Does not have to be pre-installed to do its work.

For this kind of recovery, it works quickly and well. For file (data) recovery, it can take a very long time scanning very large partitions and HD, on my 1TB home partition it can take over 3hrs to scan it entirely and identify potential recovery candidates. For data recovery, if your system is built on a single disk I’d recommend installing giis-ext4 <immediately and before there is a problem>. It will do periodic updates in the background so that when you need to recover, you can do it in approximately what your update interval is (IIRC default is 20 min). There is a bug pointing to disks that don’t contain your boot partition at the moment, so does not work with second or more disks.

HTH,
TSU

9

Great you got your stuff back, Jan Bart.

10

Me too… I think I was lucky that I stopped the format quick enough to not have my data damaged… I have since backed up the data and created a shiny new 12.2 install before copying the data back… I can breath again! :slight_smile:

11

I broke my small external 1TB USB-3.0 hard drive.

I had this external 1TB hard drive (NTFS formatted) plugged in to my PC and I was rendering some videos on the drive.

I accidentally bumped the PC, and the drive which was sitting on top of the PC fell to the floor in the middle of access, forcibly removing the USB cable and jarring the drive with the shock of impact in the middle of heavy disk access. I can’t tell if I had a physical crash of the disk, but in any case, I can no longer nominally access the drive from either MS-Windows (winXP) nor from GNU/Linux. I tried all sorts of ‘nominal’ access tricks I have learned over the years, including a “chkdsk /F” in MS-Windows (where F is the MS-Windows name for the drive) but that did not help. The drive was not nominally accessible.

I then did a surf for a GNU/Linux program to recover data off of an external hard drive and found the GNU/Linux program noted in this thread ( ‘TestDisk’ ). A quick surf on an openSUSE GNU/Linux 3rd party search engine and discovered a couple of users had packaged an ‘rpm’ for the program. So I installed it and I am now running the program ‘TestDisk’.

This is a powerful open source software legally free program (free not as in free beer but free as in the free software foundation definition of free which is even more free than free beer).

This is NOT a user friendly GUI program being terminal based, but thus far it is working and its menu driven selections make it not too difficult to use for copying files off of the failed disk. it will take a while to copy the ~500 or so GBytes off of my 1TB broken external drive but thus far so good (until the disk fails totally - which may not be far away in time).

I note this from the TestDisk web site:

Now in my case I am recovering ALL my pictures from my last vacation (to Myanmar) plus other home movies and pix. Losing the Myanmar pix would be catastrophic. I had been tardy in backing up all the data on this drive (as I was in the middle of a reshuffling / reorganizing data on my external drives). So from a personal perspective, this recovery is crucial.

I may be up for a while tonight, as from what I have read, once a drive is in this failed state, the time available to recover (while the drive is powered) is limited, and if one has success in access, one should seize the opportunity to recover while the recovery window is open (ie while it is still possible to recover).

12

On 2013-03-05 23:36, oldcpu wrote:

> I accidentally bumped the PC, and the drive which was sitting on top of
> the PC fell to the floor in the middle of access, forcibly removing the
> USB cable and jarring the drive with the shock of impact in the middle
> of heavy disk access.

This can be disastrous. My condolences.

I once destroyed a running HD by hitting the table with my
fist, perhaps after a blue screen of death at a very inconvenient time.
A region of the disk became unreadable. Had to replace it ASAP. I had a
backup of most of the data…

> it and I am now running the program ‘TestDisk’.

I know the tool. Very good.

For NTFS filesystems there are also some very good commercial tools: I
once had to use one that was recommended at the website of testdisk
(which had failed).

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

13

Hi oldcpu,again. Happy that you were able to recover your pictures from Myanmar, probably one of the items in your bucket list, a memorable one. As always and it seems lately you are my online support I have a question for you.
I have one hard disk (1 TB)which I think was knocked over by my kids. I just know that I cannot access it anymore, not recognized by openSUSE or by PartedMagic.
So my question is how would testdisk be able to identify it if it is not even mounted? Not sure that I understand how I can use it to try to recover my disk. Just install the application ‘TestDisk’ and plug my damaged harddisk would suffice?
Would ‘TestDisk’ be able to identify the hardware attached via USB? That would be great. I will try to do it tomorrow.

14

On 2013-03-06 03:16, dmera wrote:

> I have one hard disk (1 TB)which I think was knocked over by my kids.
> I just know that I cannot access it anymore, not recognized by openSUSE
> or by PartedMagic.
> So my question is how would testdisk be able to identify it if it is
> not even mounted? Not sure that I understand how I can use it to try to
> recover my disk. Just install the application ‘TestDisk’ and plug my
> damaged harddisk would suffice?

The disk has to appear as a device under /dev, that is absolutely
necessary. Don’t try to mount it. Testdisk tries to recover the
structure of the disk, whereas the sister tool photorec explores the
entire disk for files it recognizes (like photos) and copies them to
another disk (files it knows not about are ignored and lost, the tool is
not perfect). This is explained in their documentation, I think.

Another tool is dd_rescue. With it you can do an image of a severely
damaged disk and work on the image later to retrieve the data - but the
/dev/entry has to be there and work or nothing can be done - AFAIK.

> Would ‘TestDisk’ be able to identify the hardware attached via USB?

It normally does - but the usb chipset of the disk enclosure has to
recognize the disk first. If the disk suffered a hard knock, specially
if it was not powered up, it is possible that the HD survived but the
USB enclosure did not - so try another one, too. Try reseating the disk
inside before that.

–
Cheers / Saludos,y

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

15

@ dmera

I have the same understanding as robin_listas

16

Recovery is now complete (I let it run over night) and I think I recovered all ~500 GB on that 1TB broken external drive. But I have NO more spare external drive space left on my other drives. Everything is partially disorganized on my exisiting external drives as I ‘stoll’ space from external drives intended for different backup content. I think I may go out this weekend and purchase a couple of new 1.5 TB external drives so I can reorganize better.

I saw looked at on MS-Windows app GetDataBack which ran on winXP that could see the file structure of my broken external drive. But it cost $75 or so to buy the recovery key , where I can obtain a 1TB drive for that cost. Of course it is the data (pictures/memories in my case) that is worth far more than the $75. BUT I am one to prefer a free open source alternative (free as in the free software foundation definition of ‘free’ ) and hence I wanted to use an application such as TestDisk, which thankfully, in my case, appears to have worked.

17

Glad to hear it worked! I would have lost a lot of photos and things as well if Testdisk had not worked. I tried photorec as well. This program is great too. Unlike Testdisk it’s sole purpose is to rescue files. Testdisk is for restoring partitions. I ran photorec on my hard drive and it recovered all the files. It gave them all generic names so you will have lots and lots of pictures to rename but it does work.

It’s amazing how fragile external hard drives can be when in operation. I ruined a Western Digital MyBook World 500Gb disk that way. Knocked it over while it was running. Ruined the disk in it. Thankfully no data was lost and I learned a lot about restoring the onboard Linux file system but at the time I could have kicked myself!

18

On 2013-03-06 07:56, oldcpu wrote:

> Recovery is now complete (I let it run over night) and I think I
> recovered all ~500 GB on that 1TB broken external drive. But I have NO
> more spare external drive space left on my other drives. Everything is
> partially disorganized on my exisiting external drives as I ‘stoll’
> space from external drives intended for different backup content. I
> think I may go out this weekend and purchase a couple of new 1.5 TB
> external drives so I can reorganize better.

Alas! One never has enough storage…

> robin_listas;2532300 Wrote:
>>
>> For NTFS filesystems there are also some very good commercial tools: I
>> once had to use one that was recommended at the website of testdisk
>> (which had failed).
>>
>
> I saw looked at on MS-Windows app GetDataBack which ran on winXP that
> could see the file structure of my broken external drive. But it cost
> $75 or so to buy the recovery key , where I can obtain a 1TB drive for
> that cost. Of course it is the data (pictures/memories in my case) that
> is worth far more than the $75. BUT I am one to prefer a free open
> source alternative (free as in the free software foundation definition
> of ‘free’ ) and hence I wanted to use an application such as TestDisk,
> which thankfully, in my case, appears to have worked.

Me too. But believe me, we had no alternative: an internal structure of
the ntfs filesystem was lost and there was no way to recover it. I did
try testdisk and photorec: I recovered lots of multimedia files, but
other files were not found, and directory names were missing. The disk
was not mine, I was just the knowledgeable friendly (free) help :wink:

My friend wanted more.

I tried one of the tools that the testdisk site recommended (I think it
was “active undelete”): you can try it first. It started searching for
some hours, found all directories and filenames, but only did the actual
recovery of files smaller than 100K unless you paid. So I asked my
friend, and he paid happily (after some grumbling)… I did not even
have to restart the program, I just typed the registration code at the
waiting program and it went ahead recovering the files.

It might have been about 50€, I don’t remember. We were both very happy
with the result.

The problem with photorec (the other tool in the testdisk package) is
that it seeks the disk for recognizable file patterns, like jpg files. I
don’t remember what types it knows about, but other types are simply not
found. If you have a lot, say, of openoffice files they are lost, for
example.

I’m not saying that closed source software is better. I only say to keep
an open mind… use the tools that gets you there with less effort and
money.

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

19

On 2013-03-06 09:46, Dexter1979 wrote:
> It’s amazing how fragile external hard drives can be when in operation.

Indeed.

Flash technology is better for this, but… it is very expensive, and
has limited cycles. I dunno how it compares for long term storage.
Magnetic fields, electric fields and discharges… electronics ageing…

–
Cheers / Saludos,

Carlos E. R.
(from 11.4, with Evergreen, x86_64 “Celadon” (Minas Tirith))

20

Thank you Carlos for reply. Well dev has an entry for all the devices in a machine and many other things. How would I identify which is the new device added?I assume it should be under sdb sdc entry. or there is another way to identify it. or under /device/disk/by-*? no luck this way so hopefully is just the enclosure. I will added as internal drive to see if that would help(i don’t have another enclosure).