What are Reddit's favorite File Recovery Apps?

If they're just simply deleting photos then it would be a very easy task to "undelete" those photos later (provided they are not using more sophisticated methods of deletion). There's plenty of software available for the job. I'd recommend Photorec. Did you ever give something like that a go?

This is why it's important to know how to recover "deleted" photos and video, if you're using a standalone camera where you can pull the SD card (or similar storage media).

As soon as you delete your previous data, swap the media for a fresh one and quarantine the one where you deleted stuff. When you get to somewhere else, use PhotoRec or whatever recovery software you have chosen to attempt to rescue the "deleted" material.

Rehearse this scenario before it happens to you for real. Carry that spare SD card.

(Also, it can be useful to zero-fill your cards between uses, so you don't have to wade through "good-deleted" old material to find the "bad-deleted" stuff that you want to get back.)

I once did the same thing but over a buddies drive. Luckily there was only 3 important folders that he needed recovered.

I loaded a boot-able Hirens, that had recovery software included, onto a flash. There were a few apps that I could use but the very first one I used called "Aomei Back Upper".. This software took 3 days to scan the entire 2TB which in turn recovered over 4TB of data that had been on the disk prior. I searched for his folders, restored them to an external and wala.

Aomei or one of the other apps also had a "recover lost partition" option as well.

A Hirens boot CD is a must have for any techie. https://www.hirensbootcd.org/download/

You can use a tool like photorec that can recover many multimedia files from ext2/ext3/ext4.

If the files were any of this huge list of formats it's likely to be able to recover them.

> hirensbootcd.org is being developed by the fans of Hiren’s BootCD. https://www.hiren.info/ is the official homepage of Hiren’s BootCD

This is not an official version, but whatever, if it works it's good. I've been using Medicat for these years, and it has served me really well.

This won’t work if bitlocker is enabled. If it’s not encrypted burn yourself a copy of Hiren’s boot CD / USB and boot the machine with that. It will allow you to browse the disk without taking the PC to pieces https://www.hirensbootcd.org/

Just sell the whole laptop as-is on Ebay/craigslist and state that things are broken. Some one will buy it. Probably not for top dollar though.

You can probably get slightly more if you sell parts of the laptop separately as working parts. RAM, laptop DVD, battery, charger, etc. but that's more work.

The one thing I would caution you is to make sure the hard drives have been wiped first. You may need to pull them out of the laptop, mount them in an enclosure or in a desktop and overwrite everything. I use the http://www.ultimatebootcd.com/ for this. Let me know if you need more details on how to do this.

GNU ddrescue is even better.

https://askubuntu.com/questions/211578/whats-the-difference-between-ddrescue-gddrescue-and-dd-rescue

And then the recovery app to try is PhotoRec.

http://www.cgsecurity.org/wiki/PhotoRec

Image your drive, and run PhotoRec, and other tools from the TestDisk suite on the image. PartedMagic comes with TestDisk installed, or it should be in most repositories. You can forego the drive image, but you always risk writing to the drive, and hosing your recovery chances. Use bootable media if you don't go the image route.

http://www.cgsecurity.org/wiki/TestDisk

Next time you accidentally format a card, take the card from your camera, slide on the write protect tab if it has one, and put is safely away. DO NOT USE IT IN ANY WAY UNTIL YOU ARE HOME! Use your spare card (you have one, don't you?) to take pictures.

When home, download PhotoRec and use it to recover the photo's on the card. If you are not comfortable using command line utilities ask a friend who is. If all else fails, you can even try /r/linux to bribe a friendly redditor nearby who's willing to help in exchange for a meal or a good beer or stuff.

It happened to me as well. I kept the card safe, and recovered all but one picture of the 500 pictures on the card. Within one hour.

(Edit: I have more than 35 years of experience with computers. My first computer had 256 bytes of memory. This reptile has seen it all. Yes, I know there are commercial programs to recover data from flash cards, some are even user-friendly. However, PhotoRec is free, is actively supported, recognises odd image formats like most RAW image formats, video, stupid shit with hidden folders used by some manufacturers. Use it, see if it works, and then donate what you would have spend on ShittyPhotoUndelete v11.3.2.1 Pay for succes, not for the expectation of success.)

I've got an Eye-Fi card and they're pretty clever.

Being familiar with how to un-delete is even more valuable though, as it can't be spotted by examining the basic hardware and doesn't need any special hardware.

If you're expecting to need to undelete, I suggest blank-wiping your SD cards between uses (I use the free Disk Redactor), so that the recovery tools (I use PhotoRec) don't find the ghosts of your old photos which are already safely offloaded at home.

edit to add: as soon as you've been coerced in to deleting a photo you want to rescue, switch SD card - to reduce the risk of the deleted file being overwritten.

You very likely still have lots of those photos unless you have used that card a lot since then. Formatting doesn't actually do anything aside from designate that data as being able to write over. Go here http://www.cgsecurity.org/wiki/PhotoRec this is really awesome free software - you have to use terminal but it is very self explanatory if you have some computer experience. The first time I tried it I found photos from 4 months prior on my card!

The quickest way to "de-rate" a hard drive is to punch holes in it. I like to do that with a 30.06 myself, but that option isn't available to everyone. Also, when taking it apart, you get these really cool super magnets.

When I go "curb shopping", the first thing I do is try to wipe the hard drive. Who knows if the computer you pick up off the curb on trash day is infested with viruses or even if it contains kiddie pr0n. I'm not willing to take the risk, so it all gets wiped ASAP. I have a low end PC which I boot Parted Magic or DBAN or "secure erase" on (all included on the UBCD http://www.ultimatebootcd.com/ ) for the older PATA IDA drives, but I have to use my desktop for the newer SATA drives.

You should really familiarize yourself with ddrescue, it's an insanely useful tool for cloning the good portions of a failing hard disk. It's Linux only, but well worth learning about. Once you have a cloned image, you can use a tool like testdisk or photorec to actually recover the files. Obviously no substitute for an actual backup, but good to know about in case of emergency.

SERIOUSLY! THIS! It doesn't need fancy equipment, a USB card reader will recover photos.

If you have a USB Card Reader and the files are saved to a card not the phone itself the following program will "undelete" them - I do it for customers all the time.

http://www.cgsecurity.org/wiki/PhotoRec

EXTREMELY SIMPLIFIED

This works because hard drives work like a book - you have the actual pages that you read and the index in the front.

When you are deleting files, almost all the time all you are doing is removing that file from the "index".

The chapter is still in the book, it just isn't listed in the index.

Things like Windows Explorer only shows you a fancy version of the index and only opens files that are mentioned in the index.

When you add a new file, your computer finds the space in the index and puts your new data there - it may be over the top of old files, it may be in a space - it doesn't matter to the computer because it knows if a file isn't in the index it has been permanently deleted. Until that point 100% of the file still exists, it just isn't listed in the index.

The program listed above creates its own index from the files it finds.

The reason you need the USB card reader is because a lot of devices do not let you access them directly, they give your computer the index list and only serve up files on that list.

This works with cameras as well as phones of course.

Edit: Replaced tech jargon with book analogy.

Firstly Take the SD card out and do not write anything to it! Deleted data remains there until overwritten, if it hasn't been overwritten it will be easy to recover.

Find someone with a computer that knows what they are doing. This program is very good and is made for the problem you have, to recover lost photos. http://www.cgsecurity.org/wiki/PhotoRec It's probably not easy to use for someone that doesn't know much but it is a very good program. Another I have used was PC file inspector. Also if the photo's are valuable enough to you pay someone to do it for you who knows what they are doing rather than just guessing and ruining any chance of recovery.

I have had a lot of luck with the free PhotoRec but any of the others will do really. The key thing is to stop using your card. Even if you have used it a bit, you should still be able to get most of the things back but the sooner you stop using it the better.

Testdisk/PhotoRec

Active Partition Recovery

Not sure if best, but they're doing the work more or less..

Problems start when the disk is physically dying.

You probably just wiped the partition table then. It's likely that a lot of the data can be recovered. Personally, I'd send it in to a data recovery company if it were important long-term work, but if you absolutely don't want to do that then I'd do this:

1) Go buy a 1.5 TB drive from Wal-Mart

2) Copy all of the data from your 1TB drive to that as such:

dd if=/dev/1TB DRIVE DEVICE of=/media/*1.5TB DEVICE MOUNT FOLDER/drivedata.img bs=4M

3) Use something like TestDisk to recover the filesystem.

As always, YMMV.

Are we sure this is legit? The original source for Hirens has always been at: https://www.hiren.info/pages/bootcd and I see no reference to this new version or domain on the authors page.

If you used Lenovo's software to turn on the setting, IMO you'll need it again to turn it off. In other words, yes you will need a functioning Windows environment running on the laptop. However, it doesn't have to be a dangerous process, because there are ways of getting into Windows without touching your boot drive. Personally, I would recommend [Hiren's BootCD PE](https://www.hirensbootcd.org/). It's a bootable Windows installation that I know at the very least has internet support (among other useful things), so you should be able to download the Lenovo tool and use it form there.

Just for future reference - the standard program for this sort of thing is Photorec. It comes together with Testdisk, which would probably have restored the deleted filesystem, complete with folder and filenames.

PhotoRec without a doubt. Its command line so it takes some elbow grease but its free software and by far the most powerful thing I have come across. Check the wiki if you have questions. Good luck!

Make sure you don't do anything with it (always mount ro until you have recovered stuff). Now, depending on whether it fully zeroed, you should be able to recover basically all of it, since all it would have done is wipe metadata.

Try using testdisk first, which you can find on a live recovery disk. It may be able to recover NTFS metadata and allow you to just recover the partition. Usually bundled with it is photorec, a good file recovery tool. You may not be able to recover file names, but you should be able to at least grab files off it.

Once you've recovered what you can, you can try using mkfs.ntfs on the partition and then using some kind of disk checking tool/testdisk again to recover NTFS metadata to see if you can get it back. I know I've managed to mkfs.ext4 partitions in the past without losing much, but I'm not 100% sure how it'll work with NTFS.

If the data was on a removable memory card (microsd):

1. Turn phone off, remove card. Isolate it. (To ensure nothing gets written to the "empty space" where the files are)
2. Put card in card-reader attached to PC, use PhotoRec to see if you can recover the goodies.

This also applies to regular digital cameras. There are other recovery tools but of the free ones I've tried, PhotoRec has given me best results.

In case you haven't changed anything about it yet.. Use Testdisk. You can easily recover the entire partition that way, only takes a couple of minutes or so.

Try TestDisk (available on the UBCD). It will allow you to fudge the geometry to recover the files. I recently had to do this on a 4TB HDD.

I had some luck with this tool before:
http://www.cgsecurity.org/wiki/TestDisk

On the same page you'll find another one called "PhotoRec", its more useful for recovering images/videos from pendrives.

Good luck, man.

YES. Don't use the drive anymore.

http://www.cgsecurity.org/wiki/PhotoRec

1.Mount the drive

2.Read the instructions

3.Perform data recovery

PS. I've used it on a corrupted sd and recovered 100% of my data. Just let it do its job.It may run for hours depending on your hdd size.

PS2. Feel free to ask "how to" questions

Have you tried recovering the main backup image and/or corrupted partition using TestDisk? I have recovered numerous corrupted storage devices with this and a live Linux USB.

You can try restore the data with testdisk. For EDX you can try loading Ubuntu into a VirtualBox machine. But first and foremost, if you care about your data, please do a backup. Daily, weekly, monthly, whatever suits you, but do it. Now.

I had a card I was unable to pull anything off of using Recuva, but had great success (#Borat) using Zero Assumption Recovery. Got all of my wife's cell phone pictures back!

http://www.z-a-recovery.com/download.aspx

Use a Windows Preinstallation Environment like Hiren's BootCD. It's a live version of windows that works without a license. Very useful if you need to use a hardware tool that only runs on Windows.

Likely corrupted the partition tables. You can recover use of the drive by booting to a recovery tool like Hirens, wipe it and re-partition it.

If you want the data, that is a whole other issue. Some of the recovery tools on Hirens will help. But beware- if you try and fail you can very well destroy that data forever(if it was even recoverable at all). If valuable, take it to a professional data recovery outfit.

https://www.hirensbootcd.org/download/

If you are comfortable with command-line, use Testdisk http://www.cgsecurity.org/wiki/TestDisk

I've had really good success with it recovering deleted partitions and recovering files. As long as you haven't overwritten that section of the hard disk at all or too many times (and it's not damaged), Testdisk should be able to recover the partition or files for you.

I haven’t read through all the comments, but you could try testdisk to recover some, if not all the deleted files. I mainly used it to recover partitions and it worked perfectly.

There is also photorec from the same developers in case the files were incredibly important and testdisk wasn’t able to find them. Be careful with photorec, though. It will spew out every possible file it finds. I ran it for a few minutes after my laptop overheated and shutdown while I was writing something and quickly found ~20GB of useless data chucked into folders (no directory structure or anything), each containing some hundreds of files found by photorec. When I say useless, I mean thumbnails, cookies, partial screenshots of what I was doing online(only from Edge. Thanks MS. ), misread files (mp3s and oggs that were nothing but static noise. Absolutely nothing discernible) and the likes. But it also found parts of the files I needed

Ignore all the non-tech savvy people here.

If you haven't done anything yet, your data is easily recoverable.

Disconnect the drive if possible. If you are able to disconnect, put it in an external HDD reader on another device so you can mount it as another "data" hard drive vs your computer recognizing it and automatically using it. Don't shut down or turn off your computer unless you are removing the disk. That way you have a lower chance of overwriting data. If you can't do that, just don't do anything until we all figure out what partition you deleted. It's unlikely there will be data written to where your partition was, as Windows thinks it is just empty space and will ignore it.

• Step one is to use testdisk to try to recover your partition. Your partition is still there, Windows just thinks it isn't anymore. If it works, your partition tables will be restored. There might be some data loss if you already tried to make another partition where it was.

• If step 1 failed, try to get your important and valuable files out of there using photorec and copy it to an external drive or somewhere else.

Upvote for correct information.

If Recuva (which is free, btw) doesn't work, there is a more powerful, albeit slower program called GetDataBack. It's not free, it costs $79, but it's extremely powerful and designed to handle your exact situation. Once again, I can't stress enough - Recover to a completely different device than your source.

First thing, of course, is not to panic. This type of problem is something almost everyone who's built a custom machine has experienced, and almost every time, it's something pretty basic in the end. You have a faulty part or a bad connection, most likely. You need to systematically eliminate each possible bad part.

Since the machine at least tries to boot, the first thing I would do is grab a linux-based recovery live-cd, like this one: http://www.ultimatebootcd.com/

Use it to test things, see if that narrows it down. You'll probably be able to crash the machine using the CD.

Starting from any knowledge you gained from the recovery CD, isolate the problem by swapping out each part from another machine. If it crashes during RAM test, start there, etc...

I suggest, as others have, to not take the machine apart if possible -- test things in situ (in place).

Here's my rough list of things to do, restarting and trying to crash the machine between each step.

1. Bring the system to bare-bones first: remove video card and use on-board video, remove all other peripherals, including the SSD (boot from USB stick as mentioned). If you're unable to make the machine crash from linux, you can use booting into windows as your diagnostic.
2. Remove all but one RAM stick (if you can)
3. Try each RAM stick in different slots
4. Bring in a known good RAM stick from another machine
5. Swap out PSU (just hook another one up without removing the current one)
6. Swap out CPU if you can

Best of luck to you, and it may be cold comfort now, but you'll probably feel pretty good once you get this figured out :)

Also I believe you could have used those CD/USB Bootdisk software where it creates a mini-os in RAM. Then you could have accessed your HDD and moved all your important files off before it got wiped.

I'll stop you right there and ask if you wouldn't be better served with a device such as: https://www.zalman.com/na/contents/products/view.html?no=20

It allows you to place ISO files onto an external HDD/SSD which presents to the computer as a USB Blu-ray drive and USB Hard drive at the same time. With a switch you can change the drive to read only.

Store ISO files in the _ISO folder and you can choose which you would like to mount. You can then mount the rest of the hard drive as an external USB drive.

It's not exactly what you're looking for, but it's a mainstay of my tech bag. Need to boot something new? Just download the ISO and place it there, no need to burn it.

Beyond that, you might be looking for Hiren's Boot Disk. https://www.hirensbootcd.org/hbcd-v152/

Presumably the ISO was much smaller than your hard drive. So you only overwrote a small area at the start of your hard drive. The vast majority of your data is still there. The problem is that you overwrote some structures which let you find it.

If your hard drive was split into multiple partitions, you probably only damaged the partition table and the first partition. You could find other partitions via http://www.cgsecurity.org/wiki/TestDisk and rebuild the partition table to access those.

Accessing a partition whose start has been overwritten is more tricky. You will probably need to run a recovery program to search through it and copy found files elsewhere. There are many programs available. I don't know which is best.

Ok, there is a good chance everything is going to be ok. I think you just need to recover the deleted partition.

First, do not write anything to the disk. Anything copied to the disk could replace the data you are hoping to recover.

Next, try Testdisk. It has a great reputation and I have personally used Photorec to recover accidentally deleted files.

Good luck!

UNPLUG THE DRIVE AND DONT PLUG IT IN FOR NOW (more info to come in an edit)

Edit:

ok, so as I understood, the drive is connected via USB. the important thing is: when deleting a file, the computer just deletes the "reference" to the data. the data is most likely still there, but the space it takes is now marked as "available" again and will be used if you perform any write actions on the drive. one critical question is the filesystem she used on the drive. FAT32? NTFS? HFS? everything else depends strongly on your IT knowhow. I would boot up a linux system (ubuntu on a usb drive), hook up the USB drive and first start by making an image of the drive (with dd). This way I have a copy of the whole drive (watchout, the image of a 2TB harddrive will be - exactly - 2TB in size, so you need a lot of space) and can work on it without the fear of overwriting something. Making an image copy should be the first thing you to, no matter what else you want to try to recover. For the recovery process itself I would try TestDisk (or PhotoRec): http://www.cgsecurity.org/wiki/TestDisk You won't get the filenames/folder structures back, but that mostly not so important with images (as the EXIF data containing the capture date is still in the files). Honest suggestion: If they really only take 300$ for the recovery and do a good job (recover all the images), that's a very fair price and if you don't have the experience, I would suggest doing that. There is a big chance that you mess it up and you end with nothing in your hands (e.g. failing to make an image).

If it is just a bad partition table, this sounds like a job for Testdisk. It'll scan the array, search for partitions and rebuild the partition table.

You also haven't indicated how it was RAIDed (Windows/Intel fakeraid, a RAID controller etc.); if this doesn't work, that information may help.

Hopefully it's just the partition table. Best of luck!

Try TestDisk. They actually have a guide specifically for recovering files deleted from NTFS volumes:

http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_NTFS

DO NOT DO ANYTHING WITH THE DRIVE. You can usually use free software like testdisk to recover formatting. And it usually takes only a few minutes(as long as you haven't overwritten anything important). If you have installed windows 7 already shutdown and you can try to use photorec from a livecd.

Firstly, don't panic.

Secondly, if you're using one of them SD card adapters, slide it into read-only mode. Otherwise, be very careful not to write to the card, or make any changes to it.

Thirdly, follow the instructions here. If results are not satisfactory, try here.

Make an image of the drive using dd. In that case you do not have to use the card and destroy it on accident.

You can use Photorec for trying to recover your data. Might work and save you a lot of time.

It's not free, but I've had enormous success with this software: GetDataBack. You just point the software at the device and let it run. With a 500GB drive, it could take upwards of 6 hours, but I've saved dozens of customers with this software. Get the NTFS one.

Before buying, you may want to try Recuva, it's free but less powerful. If it does the job for you, then great!

• the best option to delete the files is to simply replace the hard drive with a new one and reimage it. You can then destroy the original at your leisure.

• you can take the removed drive and then scan it with the appropriate software at your leisure. My personal favorite is ZAR, but I am sure that there are others out there.

• I happen to like "Agent Ransack" for a search tool, but there are many out there, and I am sure others will recommend others. It lets you search for file names and contents by regular expression if desired.

• before removing the drive, be sure to undo any drive, folder, etc encryption.

Photorec. http://www.cgsecurity.org/wiki/PhotoRec

I know everyone's go to recovery method is recuva but I have actually had much more success when photorec. I've had multiple instances where recuva was unable to grab anything only to recover multiple files and photos using testdisk/photorec

First of all set the card to "read only" to protect further damage to the files on the card. That is the little slider on the side of the card. I have had good luck with recuva, https://www.piriform.com/recuva

PhotoRec is also free and has good reviews, though I have not tried it yet http://www.cgsecurity.org/wiki/PhotoRec

Good Luck!

After it was formatted? Absolutely yes. The data is still there. PhotoRec would get it back for you.

But if the card has already been filled again the data is gone forever. However if time is indeed cyclical you can retrieve the data with the next interaction of the universe.

Instalati-va Adblock Plus + Flashblock + Ghostery + httpseverywhere. Instalati Eraser daca vreti sa stergeti ceva de tot de pe HDD.

Folositi aplicatia asta daca vreti sa recuperati fisiere sterse.

I'm not the person you asked, but just in case anyone reading this is a Linux user, I've used photorec on Linux on both sd cards and a dying, wouldn't mount hd and recover files.

If you realy want to recover something you should disconnect hard disk and do nothing with it. Install programs on other or boot from recovery cd. Every program you install, even browsing (page history,temp files) overwrites some parts of disk and makes it unrecoverable.

I had some success with http://www.cgsecurity.org/wiki/PhotoRec but in no way it recovered everything ...

I've used http://www.cgsecurity.org/wiki/TestDisk it has a live cd. The goal for recovering deleted files is to insure that the card isn't wrote to before scanning/recovering. It'll grab everything that is a picture and copy it to another drive. Everything, as that it only guessed the names and scans the entire card for anything that looks like a picture.

Did you at least attempt to recover any of your data?

TestDisk is free software that supports many different Operating Systems and a package is available for almost any Linux distribution.

Try downloading and then burning a Knoppix CD or DVD and running TestDisk on the affected drive with that, it's well documented and a step-by-step guide is available on the web site, if you need any help beyond the scope of that guide then please feel free to reply here or PM me.

Try TestDisk next time (run it from Windows, on the RAID volume, not on individual disks (free).

Or you could try ZAR on individual drives (paid).

Even if you could get the program to launch in wine, it still wouldn't be able to recover any files. Windows normally uses ntfs as the filesystem, most desktop Linux distributions will be using ext4.

If you are looking to recover some files from a Linux partition, I would reccomend http://www.cgsecurity.org/wiki/PhotoRec, I've had success with it in the past. It runs on Windows AND Linux, and supports the most common fs's.

If you didn't fill up your drive with new datas, your old files may be recoverable. PhotoRec can recover files after disk formatting. You will find it in the ubuntu repos.

To maximize recovery chances, I would plug the drive on another computer and perform a search with photorec. This can be long, and it will recover all previous files. Folders and filenames will not be recovered.

Just a small PSA: files deleted with your regular file managers can be easily restored using apps such as photorec. I would be careful with that phone and its memory card.

This is unacceptable behavior- please do yourself a favor and cut her from your life.

I'd like to recommend you an excellent, open source disk recovery software that I've used many times. It can recover photos on Windows, Mac, and Linux: PhotoRec/TestDisk. It won't recover filenames but it gets the contents.

I was able to recover tons of lost files for a friend with this package. The package has photo in the name but it recovers a lot of different file types- I got all of my friends mp3s back with it. Good luck!

Also, you should change your password and not share it.

Yes, you could easily take out the drive and plug it into another computer. Still a good idea to back stuff up though in case your disk fails or stuff gets corrupted. 3-2-1 is a good rule of thumb

Here is a short list that should cover you for most everyday things:

• Have backups of all your important documents and photos, use the 3-2-1 rule.
• Have a boo-boo kit in your backpack or car, with bandages, pain killers etc.
• Keep an extra change of clothes in your car.
• Emergency sewing kit in your backpack.
• Always have water with you.
• Have an emergency fund.
• Store food and water, it helps incase of blackouts, water shortages, and job loss.
• Keep your phone charged(and own a battery Bank)
• Keep your car gas tank above 50%.

There's likely more, anyone else feel free to add what they feel is important bellow.

Not to dissuade you, but multiple failures might indicate a hardware or disk problem with the device. You should probably run some diagnostics on it, otherwise you might be in the same boat after switching to Linux. Here's a diagnostic disk that has a ton of utilities. http://www.ultimatebootcd.com/

PS - my vote is for Fedora.

It would probably be best to test the hard drive in another machine, that means taking the HDD out of the laptop, and putting it into a desktop PC with a spare SATA port. Once that is done, run a full Malwarebytes scan and remove anything.

If that doesn't fix anything, it could be the possibility of a failing drive if response times are being that bad.

EDIT: you can also burn or place UBCD onto a USB flash drive / CD and run a hard drive diagnostic.

I don't know if I can condone inflicting fear on personal electronics, but nuking the drive is simple enough, and a painless operation.

Top-secret-clearance route: remove the drive; put it through an industrial shredder; replace it with a new one.

The way that's probably good enough so long as the feds aren't involved: burn yourself a copy of the Ultimate Boot CD. Any of the disk wiping tools on there will do the trick, but 'Derik's Boot and Nuke' has a handy automatic mode which will securely wipe every hard disk connected to the computer; that's probably the easiest one to get going. It'll probably take a couple hours.

If you're talking about Windows at all, then no, we are not talking about the same thing. That's kind of the point, in fact; you don't need Windows just to test hardware. For instance, when I worked in IT, we used this; I still use it for personal stuff. It has tests for everything I would want to test, plus a bunch of neat utilities for partitioning and such. It's completely self-contained, and it runs either Linux or DOS. No Windows anywhere in sight. And it takes several seconds for me to put this on a flash drive.

Try Testdisk. It's a command line interface and may take some reading up on before diving into but it should work, I have had much success with it in the past. It will take a LONG time to scan however depending on your data (i.e. Hours to days). Best of luck!

It most likely isn't dead yet, I have been able to get files off of "dead" hard drives before.

Depending on the type of external hard drive you have, it most likely (99% of the time) uses a standard Laptop size hard drive. Laptop hard drives do not require very much power from an external power supply, so they work right off of the USB, thats why they use them for external hard drives.

You should be able to open up your external hard drive case pretty easily, look up a YouTube video on how to do that.

Here are some options for you once you get it open:

https://www.youtube.com/watch?v=F5Y7BniaRXg

Another option:

If you have a laptop or desktop computer you can simply plug your external hard drive hard drive into your desktop on another SATA port on the motherboard, if you do this it will give you the ability to get past the MBR (master boot record), the MBR is what boots the hard drive and if that becomes damaged or corrupted it will appear "dead", but you might still be able to access the files on the hard drive by using a program like http://www.cgsecurity.org/wiki/TestDisk

I have personally used TestDisk to recover files from someone's hard drive.

Another option:

If you choose not to do any of the other things, you can pay a local reputable company to attempt to salvage the data. I know you said you only want to know what folders you lost, but if you have some pictures or other things that are priceless to you, you may want to take a look at getting it professionally recovered.

Good luck with everything, if you have any questions send me a PM

All is not lost. Depending on the filesystem an other things you can probably still recover everything. The first that comes to mind for this is Testdisk. Don't use that hard drive anymore. If possible, install it as an addition drive into another computer. You should be able to recover your files.

Important. Try not to copy any more files onto the drive or use it until you recover your old files.

I'm going to take this opportunity to be a dick (a correct dick, mind you) and say: Always have at least two copies of your data at all times. Always. Invest in another hard drive or Crashplan or Dropbox.

Solution: Use Photorec. It's a sub-program of Testdisk.

Don't read or write anything to that drive. You'll need another working computer with extra space. Connect to that harddrive somehow and run Photorec on it. It will take a long time but it'll find all photos and media files.

Good luck!

You're probably screwed. Right now, I'd say your only hope is trying out testdisk to recover the partition, and then if you can repair the partition, try the Pointsec recovery tools on the recovered partition. You could look at enlisting a data recovery company to have a crack at it too, but I wouldn't hold your breath.

If you want to try the testdisk route, I highly recommend taking a complete image of the harddrive with something like dd or ddrescue, which performs a block level backup of the entire hard drive.

A friend of mine had good results with Testdisk after the partition table on the main drive of his HTPC took a nosedive. It was very simple to use, as well.

This was under XP, but it should work under 7. Good luck!

system rescue cd and TestDisk (which comes on the System Rescue CD)

If you have a little technical knowledge, and are willing to read a little before taking action, these will do the job of most of the paid utilities out there. I've used them successfully numerous times.

All hope is not lost, there is a chance that some data can be recovered.

This is how the ransomware process works:

When infected, the cryptographic process phones home, decides on a random encryption key, and begins encrypting files. File encryption isn't a destructive process, encrypting a file means reading the unencrypted file and writing an encrypted copy. The malware process then generally deletes the unencrypted copy.

The System Restore service on Windows also keeps snapshots of file changes, and the virus will attempt to remove previous restore points to try and prevent you from recovering files through these snapshots.

So here are your two options, aside from paying the ransom:

Download this program called Shadow Explorer: http://www.shadowexplorer.com/downloads.html

It will allow you to access the snapshots and possibly recover the files without paying.

The other option is to use something like photorec on the flash drive to try and recover the deleted non-encrypted files.

If your GF was using dropbox or Google Drive, they can roll back the changes as well.

If you want help with any of this, let me know. I own a small computer repair shop and deal with this exact scenario from time to time.

If you need to do some data recovery and the drive is giving up the ghost use photorec from cgsecurity. We run it on a debian box and is installed with the testdisk package. The bad thing about it is that it spits out almost random files so its nice to sort them. I made a sorter to do so. It works off of python 3. As long as the drive is connected it can get data.

Maybe a lab with something like teaching them how to use PhotoRec?

• They'd have to install a package
• Locate and unmount a device
• Run a program with root or sudo

I think I've amazed and thrilled more people by saving their lost photos than with any other Linux related skill.

Edit: More thoughts

If you don't have enough SD cards or small USB sticks, you could provide an image of the SD card already on their computers.

The photos/files they recover could be something linuxy like a picture of tux, or something silly like a Rick Astley video or something.

OK OP, you need to do a couple things right away.

1. Stop using the computer and that SD card right the fuck now. Especially the SD card since that's your best shot at this.

2. Get another computer with a storage device big enough to hold the entire SD card's contents. External HDD, internal, either works. Just not the Mac you were using if possible.

3. Download PhotoRec and run it on the computer with the now-empty SD card mounted.

4. Make sure you do not let it save back to the SD card. Save it to that separate storage device identified above.

5. Let it work. It will take a long time especially if you enable the brute force options in PhotoRec.

6. Review your rescued photos. Hopefully be a hero.

> when the reality is it's still there. That's how you can still recover data, granted you haven't overwritten it.

BINGO.

I took care of not editing a thing, and using the appropriate tool. Recuva didn't find the device as it wasn't mounted (corrupted). So I used "Find and mount" (LINK), and mounted the flashdrive into a virtual partition "O:". Then I used "TestDisk/PhotoRec" (LINK) to recover the files.

Amazingly, it recovered almost ALL the files I had (aprox. 3.2 GB of data). Of course I had everything backed up on my HDD, as I use the flashdrive as a portable apps device.

TL;DR: Didn't modify a file, mounted on virtual partition, recovered all data. STRONGLY recommend Photorec!

I'd look into TestDisk, a nice little free app that should be able to get back the partition on your drive, assuming you haven't started using it. There's also PhotoRec from the same people that will scan the whole disk and rescue files from the void based on signatures of known file types. I know PhotoRec sounds like it's only for Pictures, but it does all kinds of stuff.

Looks like your video device could be borked. If it is a laptop then it would be the chip itself.

You could try booting from something like The Ultimate Boot CD (use Rufus to put it on a thumbdrive), or even a Windows 7/8/10 installer thumbdrive to see if the display corruption appears there too.

It is doesn't look like this then you know there is probably an issue with your display driver. If it does appear then you know the problem is not isolated to your Windows 10 install.

I would start off by downloading the Ultimate Boot CD. It has a number of different free utilities that can test things like hard drives, processors, and yes MemTest is on there too.

It also has utilities for exploring the file system and wiping the hard drive and such, so it's a nice all-in-one utility to have (and easier than making your own)

UBCD is a great tool. I keep that with me at all times. Also customization is possible you want. That with Unetbootin to make it boot USB is perfect for keeping on the ol' key chain.

You’ve probably messed up / corrupted something critical on your hard drive or bios.

First thing I’d do in a situation like this is smashing F2, F11 or DEL on boot to see if I can get to any screen.

Next I’d try booting without a HDD plugged in to see if I got the no boot drive error.

Afterwards I’d make a USB recovery disk - https://www.hirensbootcd.org - and try booting it to fix my windows installs.

You need to move that healthy partition.

You can use something like this https://www.aomeitech.com/aomei-partition-assistant.html

I have also used the hirens https://www.hirensbootcd.org/ This has AOMEI installed on it. Download iso set it up on a usb (there's instructions) boot to environment Move partition expand partition reboot done....

Hello! If you cannot see any drives in the bios, it is possible the drive is either not connected properly, or it may be dead. We can verify this by going on another computer, and getting a USB. I would recommend downloading Hiren's (https://www.hirensbootcd.org/files/HBCD_PE_x64.iso) and then also downloading rufus(http://rufus.ie/).

Once you have a USB that is empty(EVERYTHING ON THE USB WILL BE DELETED) launch rufus, and make the Hiren's ISO bootable on the USB(if you need more specific instructions feel free to ask).

Once the USB is bootable, plug it in that laptop, go into bios and see if the bios sequence is now available.

$MFT (Master File Table) is a special file that describes allocations on the drive. If it is missing, it's not possible to determine which blocks belong to which files. There is also $MFTMirr which can be used to restore $MFT but Linux NTFS driver cannot rescue broken NTFS. You can try TestDisk to repair it or at least find most of the files.

Many of these external drives can only be read using the hardware in the case. Pulling the drive and connecting it to another PC gives you what you're experiencing.

Try using a file recovery program. I recommend Testdisk. It doesn't have a pretty user interface but it gets the job done where others fail.

If you opt to buy another drive and switch parts it may have to be the same hardware and firmware versions for that to work.

> I clicked on an option called "GPT" while on Windows

This reformatted the hard drive... :(

If you want to recover whatever data was on the drive, your best bet at this point is to try to locate your lost partition using TestDisk.

Otherwise, you can simply use Disk Utility to erase the drive as exFAT. This won't get any of your data back, but it will make the drive cross-compatible between OS X and Windows.

Your fstab statement says you're attempting to mount /dev/sda, you should be mounting /dev/sda1...

If that didn't actually screw with the drive, it could be the configuration being hung up on that faulty statement.

If it modified the drive for some reason, use <code>testdisk</code> to attempt recovering the partitition table...

I actually work for a data backup and recovery company (proof), and I've been on the phone with customers dealing with this same type of luck. It's not pretty.

"RAW" isn't a real filesystem, it's what Windows displays when it doesn't recognize what's on your disk. The fact that you should have an NTFS filesystem on there and it's not even being recognized that far is very concerning to me, because that means you've likely lost the partition boot sector (the first 512 bytes of the filesystem that should never change). The drive might be failing or have firmware issues, or (less likely) it could be a particularly concerning Windows bug.

What I would do is get your hands on a copy of testdisk, a powerful forensic tool that has saved our techs' asses a couple of times. Run it on your disk - the "Rebuild boot sector" option may save you. Make sure you tell it that it's looking at a GPT disk.

For some reason I see GPT partition tables get corrupted a lot more. So you might also want to use gdisk under Linux (and NOT ANY OTHER TOOL) to tell you if anything is awry (numbers are all over the place, tool complains that one copy is corrupt, or start sector of the only partition on the disk is >2048) and if so, wipe the whole GPT and recreate a single NTFS partition using 2048 as the start sector and whatever it suggests as the last sector.

What is the size of the unallocated portion? It's common to have a small amount at the end of drives.

If it's a large portion of the drive, you can probably recover the data from it provided the space wasn't formatted. The deallocation should have protected it from being overwritten.

TestDisk is free software, and should be able to help you recover the data if it is still there.

I had this problem and was able to recover my files.

I used ZAR to recover my files, and it worked great!

Zero Assumption Recovery, http://www.z-a-recovery.com/

This is a free tool (demo) that will work to recover all your media files, but if you choose to get a license it will recover everything.

whatever you do, do not format the card until you have tried a recovery program.

This is the software to get, and it is free. You also need photorec. Testdisk will recover a partition, and photorec will recover the photos from the partition.

http://www.cgsecurity.org/wiki/PhotoRec

Since you stated that none of them are booting and none are backed up - it all depends on how far it got. If it had just deleted the partition from the table and didn't progress further, you might be able to use TestDisk to recover the partition. If that doesn't work your only other option would be to try and use a tool like PhotoRec to recover what bits it can pick out from the drives. Though doing this at that volume of machines - I'd probably go insane.

Just remember at this point if you want any chance of recovering anything, you need to make sure whatever you try doesn't write to the drive at all.

I can't speak to the Nextcloud portion of your question, but what kind of data recovery have you attempted on the sdcard? Something like Recuva or PhotoRec should help you recover at least some of the files, if not the majority of them.

Unless the sdcard was encrypted in which case you're SOL.

Keep the clone of the phone and never write over it using any recovery software - that is make sure the recovery software reads only and doesn't attempt to change the clone. It can write undeleted/repaired files elsewhere.

I have had luck doing similar things with photorec.

http://www.cgsecurity.org/wiki/PhotoRec