Recovering data from NTFS disk
in [Debian]
|
Prev: Two computers in one: two users each with their own accounts, ?monitor, and keyboard?
Next: latest sid of Dec. 25 can't see partition
From: John Hasler on 7 Jan 2010 20:50 The filesystem on the disk is clearly toast. Mounting it as the wrong type won't help. Start looking at forensics packages: magicrescue - recovers files by looking for magic bytes myrescue - rescue data from damaged harddisks scrounge-ntfs - Data recovery program for NTFS filesystems autopsy - graphical interface to SleuthKit dcfldd - enhanced version of dd for forensics and security foremost - Forensics application to recover data guymager - Forensic imaging tool based on Qt sleuthkit - collection of tools for forensics analysis on volume and file system data tct - collection of forensics related utilities There are, no doubt, others. -- John Hasler -- To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org
From: Rob Owens on 7 Jan 2010 22:00 On Thu, Jan 07, 2010 at 08:12:27PM -0500, KS wrote: > Jochen Schulz wrote: > > KS: > >> root(a)sysresccd /root % mount -o loop -t iso9660 > > > > Why do you mount the dump file from ddrescue as ISO image? Doesn't the > > subject say it should actually contain an NTFS filesystem? I am > > surprised that this actually works. > > I tried with ntfs flag too and it doesn't mount anything. Rather gives > errors. See my other reply in the thread. > > >> /mnt/windows/rescueData.iso /mnt/cdrom > >> root(a)sysresccd /root % ls /mnt/cdrom > >> 〰〹 䝎䑒噌慮?湩㬱 > > > > Do you expect this kind of characters or is it just "garbage" (from your > > point if view)? > > Yes, it is garbage. > > >> Any advice on how to proceed from here? Or can someone suggest a better > >> method? > > > > It depends on what you want to achieve. If all you want is to rescue > > personal documents, images and the like, I suggest you to try photorec > > from the testdisk package. It can recover many files of different types > > from otherwise unusable filesystems. > > > > J. > > The person has lots of photos, movies, and software backups on the drive. > I think photorec is the right tool for you. It's part of the testdisk package, which somebody mentioned already. I've used photorec several times to recover files (all kinds, not just photos) from drives that were unreadable by other means. -Rob -- To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org
From: KS on 7 Jan 2010 22:40 Rob Owens wrote: > > I think photorec is the right tool for you. It's part of the testdisk > package, which somebody mentioned already. I've used photorec several > times to recover files (all kinds, not just photos) from drives that > were unreadable by other means. > > -Rob > > I have already started testdisk and it is analysing the disk since the last hour or so. Should be finished soon. It might give me an hint as to what is the status of the disk. Thanks, KS. -- To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org
From: Jochen Schulz on 8 Jan 2010 02:10 KS: > > > I have already started testdisk and it is analysing the disk since the > last hour or so. Should be finished soon. Good luck! > It might give me an hint as to what is the status of the disk. Install smartmontools and try to run smartctl -a /dev/sdb on it. Then post the output. It might be that smartctl doesn't work over USB. In that case you would have to connect the disk directly via SATA/IDE. J. -- I often play sports / do exercise. [Agree] [Disagree] <http://www.slowlydownward.com/NODATA/data_enter2.html>
From: KS on 8 Jan 2010 14:50
Jochen Schulz wrote: > KS: >> >> I have already started testdisk and it is analysing the disk since the >> last hour or so. Should be finished soon. > > Good luck! > >> It might give me an hint as to what is the status of the disk. No, it coudn't find any partition table after 2 passes. I started photorec and it has found hundred's of files. It says it will take around 20 more hours to finish. > > Install smartmontools and try to run smartctl -a /dev/sdb on it. Then > post the output. It might be that smartctl doesn't work over USB. In > that case you would have to connect the disk directly via SATA/IDE. > The HDD is connected to internal SATA connector. Sadly, the external USB drives sold these days don't have the capability of reading SMART data. I have an old WD external disk which does, but a newer Lacie does not and it doesn't spin down the HDD either! Waiting for photorec to finish. /ks -- To UNSUBSCRIBE, email to debian-user-REQUEST(a)lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org |