Image your drive, and run PhotoRec, and other tools from the TestDisk suite on the image. PartedMagic comes with TestDisk installed, or it should be in most repositories. You can forego the drive image, but you always risk writing to the drive, and hosing your recovery chances. Use bootable media if you don't go the image route.
You should really familiarize yourself with ddrescue, it's an insanely useful tool for cloning the good portions of a failing hard disk. It's Linux only, but well worth learning about. Once you have a cloned image, you can use a tool like testdisk or photorec to actually recover the files. Obviously no substitute for an actual backup, but good to know about in case of emergency.
Not sure if best, but they're doing the work more or less..
Problems start when the disk is physically dying.
You probably just wiped the partition table then. It's likely that a lot of the data can be recovered. Personally, I'd send it in to a data recovery company if it were important long-term work, but if you absolutely don't want to do that then I'd do this:
1) Go buy a 1.5 TB drive from Wal-Mart
2) Copy all of the data from your 1TB drive to that as such:
dd if=/dev/1TB DRIVE DEVICE of=/media/*1.5TB DEVICE MOUNT FOLDER/drivedata.img bs=4M
3) Use something like TestDisk to recover the filesystem.
As always, YMMV.
At that point in time, I said "since it was in recently we may give you a discount, but from what I can tell it will have to be built up again from scratch". I didn't break it to him that he just erased all of his photos at that point in time.
What I ended up doing is leaving him the following message: "After further review, it looks like the virus (lol) might have erased your photos. We personally can't retrieve them, but we can refer you on to a data recovery specialist who may be able to recover them. Keep in mind these people are quite expensive, you will be looking at a minimum of $500, and upwards of $2000, to get the photos back. Let us know if you want us to send the hard-drive to them". This was 4 days ago, we're still waiting from a response from him.
The funny part is about 3 times out of 5, we don't actually send it to these data recovery specialists (they do exist though). We often perform our own data recovery using RStudio or TestDisk, or in the event of physical faliure, DDRescue. If either program can't recover the data, at that point we forward the hard-drive onto the proper data recovery experts who give the customer a quote. In the event we personally can recover it, we usually charge the minimum data recovery fee (which is actually less then the specialists charge normally). Generally, the only times we have to send it to the data recovery experts is if the control board/firmware for the hard-drive is fried, or the platters have failed to the point it needs to be taken apart in a clean room. For a soft faliure (like this one) if we can't get it, nobody can.
If anyone is interested in learning more about data recovery, I haven't done much as much as the specialists, but I've personally recovered hundreds of failed/erased hard-drives for those who want to learn the basics.
Make sure you don't do anything with it (always mount ro until you have recovered stuff). Now, depending on whether it fully zeroed, you should be able to recover basically all of it, since all it would have done is wipe metadata.
Try using testdisk first, which you can find on a live recovery disk. It may be able to recover NTFS metadata and allow you to just recover the partition. Usually bundled with it is photorec, a good file recovery tool. You may not be able to recover file names, but you should be able to at least grab files off it.
Once you've recovered what you can, you can try using mkfs.ntfs
on the partition and then using some kind of disk checking tool/testdisk again to recover NTFS metadata to see if you can get it back. I know I've managed to mkfs.ext4 partitions in the past without losing much, but I'm not 100% sure how it'll work with NTFS.
In case you haven't changed anything about it yet.. Use Testdisk. You can easily recover the entire partition that way, only takes a couple of minutes or so.
I had some luck with this tool before:
http://www.cgsecurity.org/wiki/TestDisk
On the same page you'll find another one called "PhotoRec", its more useful for recovering images/videos from pendrives.
Good luck, man.
Have you tried recovering the main backup image and/or corrupted partition using TestDisk? I have recovered numerous corrupted storage devices with this and a live Linux USB.
You can try restore the data with testdisk. For EDX you can try loading Ubuntu into a VirtualBox machine. But first and foremost, if you care about your data, please do a backup. Daily, weekly, monthly, whatever suits you, but do it. Now.
If you are comfortable with command-line, use Testdisk http://www.cgsecurity.org/wiki/TestDisk
I've had really good success with it recovering deleted partitions and recovering files. As long as you haven't overwritten that section of the hard disk at all or too many times (and it's not damaged), Testdisk should be able to recover the partition or files for you.
Presumably the ISO was much smaller than your hard drive. So you only overwrote a small area at the start of your hard drive. The vast majority of your data is still there. The problem is that you overwrote some structures which let you find it.
If your hard drive was split into multiple partitions, you probably only damaged the partition table and the first partition. You could find other partitions via http://www.cgsecurity.org/wiki/TestDisk and rebuild the partition table to access those.
Accessing a partition whose start has been overwritten is more tricky. You will probably need to run a recovery program to search through it and copy found files elsewhere. There are many programs available. I don't know which is best.
Ok, there is a good chance everything is going to be ok. I think you just need to recover the deleted partition.
First, do not write anything to the disk. Anything copied to the disk could replace the data you are hoping to recover.
Next, try Testdisk. It has a great reputation and I have personally used Photorec to recover accidentally deleted files.
Good luck!
UNPLUG THE DRIVE AND DONT PLUG IT IN FOR NOW (more info to come in an edit)
Edit:
ok, so as I understood, the drive is connected via USB. the important thing is: when deleting a file, the computer just deletes the "reference" to the data. the data is most likely still there, but the space it takes is now marked as "available" again and will be used if you perform any write actions on the drive. one critical question is the filesystem she used on the drive. FAT32? NTFS? HFS? everything else depends strongly on your IT knowhow. I would boot up a linux system (ubuntu on a usb drive), hook up the USB drive and first start by making an image of the drive (with dd). This way I have a copy of the whole drive (watchout, the image of a 2TB harddrive will be - exactly - 2TB in size, so you need a lot of space) and can work on it without the fear of overwriting something. Making an image copy should be the first thing you to, no matter what else you want to try to recover. For the recovery process itself I would try TestDisk (or PhotoRec): http://www.cgsecurity.org/wiki/TestDisk You won't get the filenames/folder structures back, but that mostly not so important with images (as the EXIF data containing the capture date is still in the files). Honest suggestion: If they really only take 300$ for the recovery and do a good job (recover all the images), that's a very fair price and if you don't have the experience, I would suggest doing that. There is a big chance that you mess it up and you end with nothing in your hands (e.g. failing to make an image).
If it is just a bad partition table, this sounds like a job for Testdisk. It'll scan the array, search for partitions and rebuild the partition table.
You also haven't indicated how it was RAIDed (Windows/Intel fakeraid, a RAID controller etc.); if this doesn't work, that information may help.
Hopefully it's just the partition table. Best of luck!
Try TestDisk. They actually have a guide specifically for recovering files deleted from NTFS volumes:
http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_NTFS
Sounds like you didn't create a backup prior to formatting to ext4, correct? I'm a bit paranoid when it comes to my data, so I tend to backup before I do anything drastic, so I haven't tried to restore an NTFS partition after it has been formatted to another filesystem. However, you can maybe look at TestDisk. I believe this also comes with SystemRescueCd and SystemRescueCd may also have other tools that may be of use.
edit: Check out the wiki for TestDisk.
I've used http://www.cgsecurity.org/wiki/TestDisk it has a live cd. The goal for recovering deleted files is to insure that the card isn't wrote to before scanning/recovering. It'll grab everything that is a picture and copy it to another drive. Everything, as that it only guessed the names and scans the entire card for anything that looks like a picture.
Did you at least attempt to recover any of your data?
TestDisk is free software that supports many different Operating Systems and a package is available for almost any Linux distribution.
Try downloading and then burning a Knoppix CD or DVD and running TestDisk on the affected drive with that, it's well documented and a step-by-step guide is available on the web site, if you need any help beyond the scope of that guide then please feel free to reply here or PM me.
If you shot the photos in JPEG:
> Foremost is a console program to recover files based on their headers, footers, and internal data structures.
It only recognizes JPEG file structure, so if you're using RAW files you're SOL with Foremost.
I do not have experience with these programs, but feel free to give them a try: TestDisk or PhotoRecover
Try Testdisk. It's a command line interface and may take some reading up on before diving into but it should work, I have had much success with it in the past. It will take a LONG time to scan however depending on your data (i.e. Hours to days). Best of luck!
It most likely isn't dead yet, I have been able to get files off of "dead" hard drives before.
Depending on the type of external hard drive you have, it most likely (99% of the time) uses a standard Laptop size hard drive. Laptop hard drives do not require very much power from an external power supply, so they work right off of the USB, thats why they use them for external hard drives.
You should be able to open up your external hard drive case pretty easily, look up a YouTube video on how to do that.
Here are some options for you once you get it open:
https://www.youtube.com/watch?v=F5Y7BniaRXg
Another option:
If you have a laptop or desktop computer you can simply plug your external hard drive hard drive into your desktop on another SATA port on the motherboard, if you do this it will give you the ability to get past the MBR (master boot record), the MBR is what boots the hard drive and if that becomes damaged or corrupted it will appear "dead", but you might still be able to access the files on the hard drive by using a program like http://www.cgsecurity.org/wiki/TestDisk
I have personally used TestDisk to recover files from someone's hard drive.
Another option:
If you choose not to do any of the other things, you can pay a local reputable company to attempt to salvage the data. I know you said you only want to know what folders you lost, but if you have some pictures or other things that are priceless to you, you may want to take a look at getting it professionally recovered.
Good luck with everything, if you have any questions send me a PM
All is not lost. Depending on the filesystem an other things you can probably still recover everything. The first that comes to mind for this is Testdisk. Don't use that hard drive anymore. If possible, install it as an addition drive into another computer. You should be able to recover your files.
Important. Try not to copy any more files onto the drive or use it until you recover your old files.
I'm going to take this opportunity to be a dick (a correct dick, mind you) and say: Always have at least two copies of your data at all times. Always. Invest in another hard drive or Crashplan or Dropbox.
Solution: Use Photorec. It's a sub-program of Testdisk.
Don't read or write anything to that drive. You'll need another working computer with extra space. Connect to that harddrive somehow and run Photorec on it. It will take a long time but it'll find all photos and media files.
Good luck!
You're probably screwed. Right now, I'd say your only hope is trying out testdisk to recover the partition, and then if you can repair the partition, try the Pointsec recovery tools on the recovered partition. You could look at enlisting a data recovery company to have a crack at it too, but I wouldn't hold your breath.
If you want to try the testdisk route, I highly recommend taking a complete image of the harddrive with something like dd or ddrescue, which performs a block level backup of the entire hard drive.
A friend of mine had good results with Testdisk after the partition table on the main drive of his HTPC took a nosedive. It was very simple to use, as well.
This was under XP, but it should work under 7. Good luck!
system rescue cd and TestDisk (which comes on the System Rescue CD)
If you have a little technical knowledge, and are willing to read a little before taking action, these will do the job of most of the paid utilities out there. I've used them successfully numerous times.
$MFT
(Master File Table) is a special file that describes allocations on the drive. If it is missing, it's not possible to determine which blocks belong to which files. There is also $MFTMirr
which can be used to restore $MFT
but Linux NTFS driver cannot rescue broken NTFS. You can try TestDisk to repair it or at least find most of the files.
Many of these external drives can only be read using the hardware in the case. Pulling the drive and connecting it to another PC gives you what you're experiencing.
Try using a file recovery program. I recommend Testdisk. It doesn't have a pretty user interface but it gets the job done where others fail.
If you opt to buy another drive and switch parts it may have to be the same hardware and firmware versions for that to work.
> I clicked on an option called "GPT" while on Windows
This reformatted the hard drive... :(
If you want to recover whatever data was on the drive, your best bet at this point is to try to locate your lost partition using TestDisk.
Otherwise, you can simply use Disk Utility to erase the drive as exFAT. This won't get any of your data back, but it will make the drive cross-compatible between OS X and Windows.
Your fstab statement says you're attempting to mount /dev/sda
, you should be mounting /dev/sda
1...
If that didn't actually screw with the drive, it could be the configuration being hung up on that faulty statement.
If it modified the drive for some reason, use <code>testdisk</code> to attempt recovering the partitition table...
I actually work for a data backup and recovery company (proof), and I've been on the phone with customers dealing with this same type of luck. It's not pretty.
"RAW" isn't a real filesystem, it's what Windows displays when it doesn't recognize what's on your disk. The fact that you should have an NTFS filesystem on there and it's not even being recognized that far is very concerning to me, because that means you've likely lost the partition boot sector (the first 512 bytes of the filesystem that should never change). The drive might be failing or have firmware issues, or (less likely) it could be a particularly concerning Windows bug.
What I would do is get your hands on a copy of testdisk, a powerful forensic tool that has saved our techs' asses a couple of times. Run it on your disk - the "Rebuild boot sector" option may save you. Make sure you tell it that it's looking at a GPT disk.
For some reason I see GPT partition tables get corrupted a lot more. So you might also want to use gdisk under Linux (and NOT ANY OTHER TOOL) to tell you if anything is awry (numbers are all over the place, tool complains that one copy is corrupt, or start sector of the only partition on the disk is >2048) and if so, wipe the whole GPT and recreate a single NTFS partition using 2048 as the start sector and whatever it suggests as the last sector.
First, this is why you do backups. Email them to yourself, create a gmail account and send them there, send them to your friends, upload to a website, anything! But get them off that machine. It costs nothing, it saves your ass.
Second, that it says you need to reformat is Good News. You have hope. Have a look at Recuva, which is free. If it can't find anything, also have a look at TestDisk and perhaps HandyRecovery (although the last one costs dollars, the trial will tell you if it can find stuff.) At this point, you don't need to care whether it's open source or not.
What is the size of the unallocated portion? It's common to have a small amount at the end of drives.
If it's a large portion of the drive, you can probably recover the data from it provided the space wasn't formatted. The deallocation should have protected it from being overwritten.
TestDisk is free software, and should be able to help you recover the data if it is still there.
It's not a GUI if that's what you're looking for, but it is so damn powerful. Checkout TestDisk http://www.cgsecurity.org/wiki/TestDisk
It's open source, very good step-by-step documentation, and is executable on several platforms. It works on most of the popular file formats (I'm not sure about APFS though).
Worst thing that happened to me re: drives:
I had two drives fail on me at the same time. One physically, and one corrupted beyond recovery (and my day job is as a computer support tech - I've recovered some drives that even I was surprised were recoverable. TestDisk is pretty awesome sometimes).
Naturally, I had a third drive with most of my data on it.
...Everything except the final copy of a session I did with a band that wanted to re-mix something a while after the record was done. The only copy I had was not only missing final mixes, but some of the later overdubs. Ouch.
Then a few weeks later my house was robbed and my computers stolen, but none of my music or recording gear. But that's an entirely different story.
>I was attempting to make a copy of two partitions onto another drive.
Perhaps use Partimage or Clonezilla or summat?
Here's the list I did some months ago.
I haven't used Cureit. I pefer Hitman Pro which uses the definitions of 5 AV scanners, and is usually done in 5 miniutes. I would also have to look into GMER.
I have never gotten much use out of SpinRite. For file recovery, I usually use TestDisk, and for a live enviorment, I use Hiren's Boot CD.
You have an overall good list though, and I would not mind checking out some of those utilities.
Because it would have cost me over $1k to have someone restore the files on my laptop's crashed dual boot hard drive. And, the Windows software I bought and tried failed miserably. But, using Testdisk http://www.cgsecurity.org/wiki/TestDisk (open source) I was able to restore many to my external hard drive using my Ubuntu 10.10 machine and a Thermaltake BlacX Duet. With a little more effort, I could probably restore almost, if not all of them.
Sounds like you moved rather than copied those pics. If you have them copied to your pc then just look at their exif data (right-click, properties, data from your filemanager). If you've lost all your pics then:
Try with TestDisk / PhotoRec: it's free, open source, and give better results than many many commercial data recovery tools.
It requires libjpeg and ntfs-3g.
To build ntfs-3g:
./configure --exec-prefix=/usr/local --enable-posix-acls --enable-xattr-mappings
To build TestDisk / PhotoRec:
LDFLAGS="-framework CoreFoundation" ./configure --with-ntfs3g-lib=/usr/local/lib/ --with-ntfs3g-includes=/usr/local/include/ --with-jpeg-lib=/usr/local/lib/ -with-jpeg-includes=/usr/local/include/
Others have probably already mentioned but absolutely stop using the laptop. Even just starting it may cause the area your files were in to be partially overwritten.
/u/zimmertr mentioned Testdisk. This is by far your best bet. I've had it dig out files none of the other recovery programs could touch.
It's not that hard to use, under Documentation on the main web page there's a step by step tutorial.
I used a program called testdisk to recover stuff from a corrupted HDD a few times. It's a pretty powerful tool, and free, but it's a little confusing to use. http://www.cgsecurity.org/wiki/TestDisk
If there is one program that has been able to recover data for me that seemed absolutely irrecoverable, it is TestDisk. Had a solid state drive at work that lost its partition information somehow, causing all files on it to disappear. Tried Recuva, no dice. Tried a couple other tools as well, but with no success. This tool did the job for me though.
I will admit though, if you are not familiar with the command line, it will not be very user friendly for you. It does have a step-by-step guide though that can get you in the right direction. If you need help using it though, feel free to reach out.
I don't know AVG very well but I don't think that there is any archive if the file got deleted. Some AV have a quarantine option maybe you have luck
If there is nothing like a quarantine you can try data recovery tools like Recuva or TestDisk&Photorec. I would also recommend to boot from a boot disk to do that. That prevents any new write cycles on your hdd and could prevent that the unlinked files get overwritten.
There are a couple of file recovery tools available. The one I've had the best experience with is TestDisk http://www.cgsecurity.org/wiki/TestDisk. I've used that tool a number of times and it works great.
<nerdypart>
The most important thing is to make sure there are no more writes to the hard disk that might corrupt the data more than it already is. TURN OFF THE MACHINE NOW!!
In general there are two ways to go about recovering the data:
recommended Create an image of the hard drive. This can be done by either pulling the hard drive out of the laptop, slapping it into a USB harddrive case and then creating an image from it; Or you can boot into a Live CD on the original machine, attach an external storage device and image to that device. Once you have the disk image you can point TestDisk to the image and start recovering the data.
easy Boot to a Live CD with TestDisk installed (Or install it after boot) and run test disk directly. You can recover the files to some external storage.
Keep in mind that it's very likely that you will not be able to recreate the lost partition, but you should be able to recover most if not all of the files.
</nerdypart>
First, make sure the SATA mode is set to RAID in the BIOS Setup. If it is and it doesn't help, then you have the following choices:
If the data is important, use a commercial RAID reconstructor tool Runtime Software's RAID reconstructor. Or contact a professional data recovery firm.
If it's not all that important, but it would still be very convenient to have it back, then you can try the following procedure:
Even on a healthy drive, writes to the drive make it harder to recover files. The more writes you do, the more likely previous data will be overwritten. A Windows install will write a ton of files.
I assume there was only one partition on the drive, ie there was a C: but no other drive letters for the hard disk. (Drive letters for CD/DVD roms etc don't count). If there were multiple partitions, everything not on the Windows partition (almost always C:) could be recoverable but, again, once you start writing to those partitions, it gets harder to recover files there too.
Think of the drive (or Windows partition) as a big wall. You had all sorts of stuff painted on it. Installing Windows on it paints in lots of places. The stuff it paints over is gone. Anything else should be recoverable. If the drive is small and Windows 7 (and temporary files etc it uses) fills almost all of it, then very little will be recoverable. If the drive is huge and Windows only uses a tiny piece, quite a few files may be recoverable.
That's for a healthy drive. Add in a drive that may be going bad and the odds of getting files drops even more. It can be done, especially if the drive is very large.
Some good news is that, despite being a very everyday thing, booting is a hard-core process. A drive that won't boot doesn't mean it's totally dead. Many files may still be readable.
-> It doesn't hurt to try.
I'm not an expert on which tools to use for this. I've used TestDisk in the past. It seems as good as most - and free. Maybe others have other recommendations.
Best of luck.
What did you format the drive as? (I'm assuming NTFS as you've mention seeing files much bigger than ~2GB)
I'd probably recommend giving TestDisk a try, as it's always worked wonders for me. Be careful, though - you could easily make the situation even worse!
I think you already know this, but try and avoid writing anything to the drive (including formatting it) where possible.
Weird!
Unlikely, but maybe you need to
sudo apt-get update
I'm on 14.04LTS and testdisk is right there! I just installed it.
Here's its homepage. There are binaries there for various operating systems.
Try using TestDisk and see if it can find the old filesystem that was formatted. If so then the only file that you need to recover is %windir%\system32\config\SOFTWARE (usually c:\windows\system32\config\SOFTWARE). If you can recover that file then you can use the program that /u/clt829 linked to and find your old product key. To do so, simply run the program and select "File" > "Select Source" and then in the dialog box that pops up, select "Load the product keys from external software registry hive" and then click the "Browse" button and select the file that you just recovered. Testdisk is very easy to use but can look somewhat cryptic/overwhelming if you've never used it so don't be afraid to ask if you have any questions or need me to make a step by step how-to for you. Good luck!
You can try to recover the old partitions on both drives with TestDisk. If that doesn't help though, probably your data was overwritten.
You can run TestDisk from the Ubuntu Live environment on the installation medium.
TestDisk is free, and can indeed recover files from deleted ExFAT partitions such as that of your phone's flash card. Good luck, and let us know if you'd like further guidance.
With some luck, all it did was delete the partition table. If not, we may be in some trouble. Either way, the tool you will want to look into is testdisk.
You could try fdisk or similar, but without knowing exactly how the parition table was set up - it's likely to cause more issues then solve.
Back it all up, delete the RAID set in the BIOS Setup/RAID Setup (tool), set the system to AHCI in the BIOS Setup and restore the data. You could use a drive imaging tool like Acronis or Drive Image XML. Clonezilla may work too, but the underlying Linux distro must support your software/fake/BIOS RAID config.
If you don't have any space to store the data, and you want to take crazy risks, in theory you can delete the array and recover the partitions (on one of the drives) with Testdisk. Deleting the array (with Intel RAID, and probably all others) only deletes the RAID config data and the partition table.
http://www.cgsecurity.org/wiki/TestDisk this has worked fine for me, I think you need to get it in MTP mode, or USB storage... forget which. Just remeber to save recovered files to PC and not back to the tablet!!
http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_FAT instructions. Hope this helps :)
If it was simply a format then you can use Test Disk and probably get all of the data back. I haven't had the opportunity to use this yet but people on here say it is awesome.
The first thing you have to do is stop creating any new files on that computer, period. You don't want to overwrite that work.
Then what I would do (and this might not be the way others would do it, but it's where I would start) is get my hands on another Mac, get a Firewire cable capable of connecting the two Macs, and boot up the one with the deleted project while holding down the T key to go into Targeted Disk Mode. That Mac's hard drive should then appear as a mounted disk drive on the other Mac.
Then I would run the free, open source, Terminal-based TestDisk on the other Mac and use it to recover any deleted files and cross my fingers. If the Mac I'm using to do that doesn't have sufficient disk space, I'd try to scrounge up an external hard drive that does.
It might be possible to run TestDisk right on the affected Mac but I would be leery about doing that.
You would first want to try its sister product TestDisk which can rebuild partitions quickly.
At this point though, I'd let PhotoRec complete then run TestDisk after.
Alright then, first thing to do is download testdisk onto anything NOT that drive. Put it on your boot drive. Next, we're going to need a place to store the recovered file. Which means you're going to need another 3TB drive to drop it onto. Is that available?
You may be able to recover data, but it is advisable to create a disk image first, before the drive dies completely. You should be able to clone the disk by booting from a LiveCD opening the terminal and doing something like "dd if=/dev/sda/ of=/media/HDDRIVE2GO/disk.img conv=noerror,sync". This assumes that the drive to be recovered is /dev/sda and the other one is the recovery drive and filename you want. The conv=noerror, sync tells it to not stop on errors and to pad the files with 0s for bad blocks it encounters. Make sure that you have enough space on the other drive before starting and don't mount the drive you're recovering. This will take a long time. Once you have an image, you can use a tool like testdisk to attempt recovery. Actually, now that I think about it I don't know how testdisk does with HFS+. If you're uncomfortable with dd you could use ddrescue or dd_rescue (IIRC GNU ddrescue is the better one, but I'm not 100% sure). Other than that, the errors you're getting are probably due to a file permissions thing. OSX is UNIX, and the UID for the file owner is different from the default Ubuntu uses. I would try to chown them and see if that works. Either way, make sure the bits are on a working disk before attempting recovery.
Try using testdisk to try recovering data. it can be installed running a live session, get a spare drive, and recover the data with it. here's a link to directions on how to use it: http://www.cgsecurity.org/wiki/TestDisk
testdisk.
http://www.cgsecurity.org/wiki/TestDisk
It works on console, so it is not very noob friendly. It is also cross-platform, which is great.
All the other recovery programs, mostly with GUIs, have failed on me. I have erased a partition, created new one, then erased it. I also put data accidentally during the process. But testdisk saved my ass.
Here is the downside: After rescuing data, my hard drive became unstable. But on any day, I would prefer saving my data to a stupid hard disk. I ended up buying a new one.
Sorry I left you hanging there, I had some urgent things to do.
I assume you still have a functioning PC at your disposal.
Download TestDisk and do a deep scan. It should pick up your missing filesystem. This is a very straightforward explanation of how to use it.
Post here if you have any questions.
No idea what you did that caused the deletion - that's a wall of text you have there :). However, try TestDisk. An RL friend of mine had great results pulling back deleted files with it.
[edit] Also - install it to a USB drive if you can - try not to put anything new on the drive you deleted those files from, as that may well render your files unretrievable.
Also - MAKE BACKUPS![/edit]
Upvote for TestDisk as OP's best chance. Their wiki seems to suggest it's best for recovering from ext2; ext3 & ext4 (which OP is almost certainly using) may see it limited to partition, rather than file-, recovery. If OP could post back how he gets on, we'll all be the wiser for it!
Linux files are much, much harder to recover than Windows files, although on the upside n00b mistakes like rm -rf usually only happen once.
have you tried using any data recovery tools yet? TestDisk is a good free one: http://www.cgsecurity.org/wiki/TestDisk
I'd recommend taking a snapshot of the HDD then trying to recover from the snapshot - that way you don't put the external at risk of being further damaged.
Starting to feel like I'm re-posting this too much, but I'm also kinda amazed how many data loss posts there are related to partition / filesystem issues.
Anyway, take a look at TestDisk. It should be able to read the original NTFS partition and re-write the partition table.
avoid writing any files to the drive
The program TestDisk can recover a deleted partition. It's FOSS and will work on any operating system. If that doesn't work....
If you have money to spare, Seagate's file recovery is what we use in the shop. https://services.seagate.com/diysoftware.aspx It will scan for free but won't recover anything until you pay seagate. Interface is not very intuitive and it can take days to scan a large drive.
The makers of CCleaner have recuva which many people have been pleased with. Free
You can try booting a Linux live cd to see if it will mount there. The nuclear option if you really want to get data off it would be to try to make an image of the sdcard and run the TestDisk suite on it. TestDisk scans the image file (or disk directly, but not recommended) for recognized file types. I've had excellent luck with it.
By changing filesystem you effectively formatted the drive but you should be able to recover most of it or even all. There are many ways to do so, such as with Hiren's Boot CD or Test Disk.
Maybe someone with professional experience can be more specific.
Also I'm sure it goes without saying that if you have a 2TB drive for media then surely you should keep that 40GB of documents and music on it?
Don't get your hopes up. This will be difficult.
I would go about it like this:
First, get a dump image of the whole partition to some other media like an USB disk so you will be able to go back should you further destroy the filesystems.
Then, mark the partition as Linux again using (Linux) (c)fdisk.
~~Format it again as ext3, if at all possible using the exact same command that was used to create it in the first place.~~ EDIT: on second thought, do not immediately do this, but use mkfs.ext3 -n
to find out where backup superblocks are, and see if you can pass them to fsck -b
. Also, lookup fsck.ext3 -S
in the man page.
Now, go over it with TestDisk and foremost and hold your breath.
In the mean time, you can go over the image dump you saved using an advanced hex editor with a search function and try to find pieces of strings you know are in the files you are missing. Works well for source code and email - other files, not so much.
Good Luck!
You will need a second PC to download the Windows ISO file and use either Rufus or Windows 10 media creation tool to make a bootable USB . You can't just copy the ISO to the USB drive, the USB has to be specially formatted so that it can run from the USB.
Then when installing windows do not install on the damaged drive, instead install on the new drive. My advice is to completely disconnect the damaged drive to prevent accidentally installing it on there. Then when the windows is fully installed you can then see if you can recover the files from the damaged drive. There are a number of tools available to try out some free as well.
After windows is installed see if your computer can see the damaged drive, if you get a message that the drive needs to be formatted DO NOT click ok or whatever to format it, basically Windows thinks the drive has no data even though it does.
Instead you can use a tool like TestDisk to recover the partition. Make sure to read how to use TestDisk and even though its a commandline app it actually works rather well. If TestDisk works, copy all you files to the new drive ASAP since you may not have much time before the HDD gives up the ghost.
Try testdisk. It might recover your HFS+ partition and you will be able to browse your files and folders. If no,t at least, you might be able to scan the drive at low level and recover all (or almost all) your files, but without keeping its original filename nor the folders structure.
Well, you can try testdisk from cgsecurity to see if it can just find and restore the lost partition. It's cmd based, but pretty easy if you just read what's it says and make appropriate selections.
If that doesn't work, then you'll probably want to scan the whole drive using R-Studio.
Also, you should be aware that if this was a My Book drive and you removed it from the enclosure, any data previously written to it would have been encrypted by the USB bridge board.
You can try to use TestDisk to get your old partition(s) back.
Have a look at your drive with CrystalDiskInfo. Does it show any problems? Unfortunately drive testing tools can only show a problem, but not the absence of one (Caution = bad drive, Good = possibly good, possibly bad).
I believe Seagate disks send bogus error rates, but I have not used Seagate drives in a long time. Run tests regularly with smartctl -t short /dev/sdX
.
If your drive still shows up, you might have some luck with testdisk to recover the data.
Do you have a windows computer? If so, attach your drive (assuming it isn't HFS-formatted) and run Recuva. The free version should be good enough. I assume there are Mac-specific programs that do the same thing, but I can't name any offhand.
If it isn't, use testdisk (for Mac and Windows). It's a finicky program and sometimes you need to recover folders one by one (if you try to recover them all at once and it encounter a corrupted file, the program can crash, and you'll need to remount the disk and restart the program). It is, however, an absolute godsend. Make sure you have another disk to recover the files to though.
Word of warning, Testdisk has a bug where it can continue to suck up system resources after the program has been quit. Use activity monitor to kill the offending process (helpfully called testdisk).
Good luck! If you need a hand, let me know. I used both last year to recover files that were deleted by ransomware and lost in a fall to a concrete floor.
Give Testdisk a try.
Very Important stop using the machine the files were on, use another machine to download Testdisk and create a bootable disk. I don't use Macs but I'm sure the underlying file system works in the same manner as on Windows in that once the files are deleted the area is marked as available for the system to overwrite. So ANYTHING written to the disk has the potential to be overwriting the data you want to recover. Even if you don't download or save a file the system itself is constantly doing disk writes of one sort or another.
Give Testdisk a try, if Testdisk can't recover them then your only option is a professional recovery service. Part of Testdisk is PhotoRec, specifically for photo recovery.
Since you formatted the disk though I think your chances of recovering any significant number of pics is slim.
IT guy here. Some data may be recoverable.
Get new SSD and re-load your system. Find the correct adapters, and plug in the drive to your computer and run "Chkdsk"
You can use something like TestDisk to try to recover the partition, it's free though the interface is a bit obtuse. You might be out of luck since it's fat32 though, the filenames are important and they may be lost; not sure though as I haven't had to do this in a while.
You need to delete the array, then recreate it and restore the partitioning metadata with TestDisk. When you do this, it's absolutely vital that:
During both the deletion and recreation of the array the software will warn you it will erase the data, but in reality it only erases the partitioning metadata. 100s of people were able to successfully recover their Intel RAID this way.
If you want the data back you can try testdisk. It can even restore partition tables, if nothing has been overwritten. When some data is destroyed, you can restore the files that are left.
My HDD in my Mac failed and would give me that error when I would boot into my Windows 10 partition. I used TestDisk just a few days ago to recover data. It worked great. I could see what files were corrupted and I was able to save a lot of data!
What do you mean by the code was wiped? Unless the files were overwritten with completely corrupted contents, you may still be able to recover some of the contents with a file recovery tool like this: http://www.cgsecurity.org/wiki/TestDisk
That will read every sector on your disk and you can search for a unique string in the files to find them like a variable name or any of the ones in the exe which were already extracted.
After two months the odds aren't going to be great since those sectors could possibly have been overwritten in the interim by some other file being saved to disk, but generally these tools do work as advertised if you have simply deleted something.
So when I went through this I ended up deleting the partition, doing a quick format, and then running a recovery tool. While the recovery tool was running it was finding all my old content but I didn't have the patience to wait the 5-6 hours for the thing to complete.
You may want to do some research on "recover raw hard drive" and look into the following:
http://www.cgsecurity.org/wiki/TestDisk http://www.easeus.com/datarecoverywizard/recover-raw-drive.htm
Then I'd say you have two options: recover the data with a tool like ProSoft Disk Recovery. That will scan each sector of the physical disk and dump whatever data it can find into a folder of your choice. After that, erase the whole disk and partition it freshly.
You can also try and rebuilding the partition table with an app like TestDisk, but I'd only recommend attempting that if your data is backed up or recovered, and you have some degree of comfort with the command line.
This is its homepage where there's guides with screenshots and whatnot: http://www.cgsecurity.org/wiki/TestDisk
Check out the "step by step" documentation page and in there look at the part where it talks about "quick search" (and the steps surrounding that).
Again, I have no idea if it knows about and can search for LUKS stuff on a disk and do something useful in your case. :(
Can you not use LAN or is it a netbook? You can try this first(probably much easier) http://www.howtogeek.com/112888/3-ways-to-access-your-linux-partitions-from-windows/ if no luck then on the windows pc you can mount the drive and use either GetDataBack for NTFS or TestDisk I swear total loyalty to those two programs. With GDBNTFS you can create an image of a partition as well.
Don't overwrite anything on the disk! There are several programs that can be used to recover data, if you just deleted the current partition without formatting you can use this to recover your partition tables. If you formatted it, it can still be recovered but I haven't done it myself. Just don't write anything on the disk.
Could give testdisk a spin. I've had it save my ass a few times. I mostly used it to reconstruct damaged partitions from dying HDDs, but it can undelete partitions as well.
You could watch tutorials for testdisk.
This tool attempts to reconstruct the lost partition table.
Additionally, check the health with hard disk sentinel. It may be dying. The trial is fine.
if you don't have a bodged filesystem on your hard disk (seriously, step one is run fdisk) then I'm guessing you've done something dumb with grsync.
Use a good recovery suite... I'm trying to remember the recovery/undelete tool I used to undelete ~80GB of wii backups I made but can't quite. It may have been http://www.cgsecurity.org/wiki/TestDisk
Stop using your computer right away. Use a tool like TestDisk through a bootable live CD/USB to see if you can still recover the deleted file. You might get lucky.
Either way, make backups in the future.