[opensuse] Data recovery?
I am working on trying to recover some data from a hard drive (FAT32 formatted). The drive can be mounted OK (mounted in a USB external drive housing), but the data is not accessible. When I do an ls -al, I get this back: ============================== /media/usbdrive> ls -al total 32 drwxrwxrwx 5 root root 16384 2008-06-21 17:28 ./ drwxrwxrwx 5 root root 16384 1970-01-01 01:00 ../ ?--------- ? ? ? ? ? Backup ?--------- ? ? ? ? ? Vids_1992 ?--------- ? ? ? ? ? Photos_1992 ============================== So... something is seriously wrong... obviously... but the question is... is there any hope? Does anyone know any method, or tools (Linux, Windows, whatever) that can be used to recover at least some of the data? C. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Clayton skrev:
I am working on trying to recover some data from a hard drive (FAT32 formatted). The drive can be mounted OK (mounted in a USB external drive housing), but the data is not accessible. When I do an ls -al, I get this back:
============================== /media/usbdrive> ls -al total 32 drwxrwxrwx 5 root root 16384 2008-06-21 17:28 ./ drwxrwxrwx 5 root root 16384 1970-01-01 01:00 ../ ?--------- ? ? ? ? ? Backup ?--------- ? ? ? ? ? Vids_1992 ?--------- ? ? ? ? ? Photos_1992 ==============================
So... something is seriously wrong... obviously... but the question is... is there any hope? Does anyone know any method, or tools (Linux, Windows, whatever) that can be used to recover at least some of the data?
C.
Hi, - not long ago this was discussed on this list. I myself did a recovery of an erased USB(fat) stick some time ago. I think I used this: http://www.pcinspector.de/file_recovery/uk/welcome.htm or http://www.rfc1149.net/devel/recoverjpeg or http://www.remote-exploit.org/backtrack.html And Ubuntu is supposed to have a thing called Magicrescue... Hope these links are of help. -- ------------------------------ Med venlig hilsen/Best regards Verner Kjærsgaard Open Source Academy Novell Certified Linux Professional 10035701 ------------------------------ -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Mon, Sep 1, 2008 at 10:18 PM, Clayton
I am working on trying to recover some data from a hard drive (FAT32 formatted). The drive can be mounted OK (mounted in a USB external drive housing), but the data is not accessible. When I do an ls -al, I get this back:
...
So... something is seriously wrong... obviously... but the question is... is there any hope? Does anyone know any method, or tools (Linux, Windows, whatever) that can be used to recover at least some of the data?
Hi, First of all try to make full image of formatted drive, save to some safe place and make all experiments with a copy - you can check out the ddrescue utility for that (http://www.garloff.de/kurt/linux/ddrescue/). Then I can't give linux tools for that - I just had such problem few years ago - I had to resurrect photos from photo memory card - and did try some programs under windows. There are 2 general types of tools for that - the 1st ones do scan file system header table and try to search file names which were marked as deleted, but still point to some address in the hard drive - so they display the list of corrupted filenames and you try to check them one by one and see if something is alive. If you have written a number of small files to the corrupted disk after that, the record in the file system table might be overwritten by the new names, and though the file body would still be present physically on the disk, this type of recovery tools will not find it. The 2nd type does not care about file table - it scans the whole disk image and searches the files of the particular type by their header. For example, you tell it to find all jpg images on the disk - and it starts searching for them sector by sector and puts everything it finds to some output folder. Executable programs etc are not recovered by this method, but actually I did not care about them I did not have much success with the 1st type of tools, and the 2nd tool saved me most of the lost photos (I have seen only one tool of such class - "PC Inspector Smart Recovery" - I have found it here http://www.snapfiles.com/screenshots/smartrecovery.htm - it seems to be free). I can advise you to try them all - some program can recover the files which would not be recovered by another program and vice versa. And actually, I still keep the 1gb image of the memory card - not all photos were recovered correctly at that time and I hope to try some other tools once - would be interesting to learn about linux tools for that. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
http://www.rfc1149.net/devel/recoverjpeg Thank's for that link - looks interesting for me to try
Also found another similar tool set for linux: http://anyfs-tools.sourceforge.net/man8/anyfs-tools.8.html -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Monday 01 September 2008, Clayton wrote:
So... something is seriously wrong... obviously... but the question is... is there any hope? Does anyone know any method, or tools (Linux, Windows, whatever) that can be used to recover at least some of the data?
Hi Clayton, First of all, make an image of the entire drive using ddrescue or just plain old dd and work on that image. That way, you won't make any mistakes you will regret later. I have successfully used a tool called "autopsy" in the past, to recover files or even fragments of files out of a disk image. It's actually a tool for forensic analysis of drives, but it can work on damaged drives too (images thereof). I use it in combination with Sleuthkit, which provides a web interface to autopsy. Both are Linux tools, and both are in the openSUSE repos (at least for 10.3). Good luck! Joop
First of all, make an image of the entire drive using ddrescue or just plain old dd and work on that image. That way, you won't make any mistakes you will regret later.
Excellent suggestion :-) One I hadn't thought of for some reason.
I have successfully used a tool called "autopsy" in the past, to recover files or even fragments of files out of a disk image. It's actually a tool for forensic analysis of drives, but it can work on damaged drives too (images thereof). I use it in combination with Sleuthkit, which provides a web interface to autopsy.
Both are Linux tools, and both are in the openSUSE repos (at least for 10.3).
There are some excellent suggestions here. A big thank you to everyone! I knew there had to be some Linux tools we could tinker with and try... now the problem is finding time to do a little surgery on this drive :-) I have a feeling it'll be about a week until we can spend some dedicated time on this. I'll report back any success or failures. C. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Tuesday 02 September 2008 09:21:30 am Clayton wrote:
There are some excellent suggestions here. A big thank you to everyone! I knew there had to be some Linux tools we could tinker with and try... now the problem is finding time to do a little surgery on this drive :-) I have a feeling it'll be about a week until we can spend some dedicated time on this. I'll report back any success or failures.
You're very welcome! Hope you succeed in rescueing the data. Good luck, Joop ------------------------------------------------------------ Dit bericht is gescand op virussen en andere gevaarlijke inhoud door MailScanner en lijkt schoon te zijn. Mailscanner door http://www.prosolit.nl Professional Solutions fot IT -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Clayton escribió:
So... something is seriously wrong... obviously... but the question is... is there any hope?
first.. did you run fsck.vfat on it ? Does anyone know any method, or tools
(Linux, Windows, whatever) that can be used to recover at least some of the data?
There is a method that works most of the time, it is called "backup your data for god-sake" ;) -- "A computer is like an Old Testament god, with a lot of rules and no mercy. " Cristian Rodríguez R. Platform/OpenSUSE - Core Services SUSE LINUX Products GmbH Research & Development http://www.opensuse.org/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Clayton wrote:
I am working on trying to recover some data from a hard drive (FAT32 formatted). The drive can be mounted OK (mounted in a USB external drive housing), but the data is not accessible. When I do an ls -al, I get this back:
============================== /media/usbdrive> ls -al total 32 drwxrwxrwx 5 root root 16384 2008-06-21 17:28 ./ drwxrwxrwx 5 root root 16384 1970-01-01 01:00 ../ ?--------- ? ? ? ? ? Backup ?--------- ? ? ? ? ? Vids_1992 ?--------- ? ? ? ? ? Photos_1992 ==============================
So... something is seriously wrong... obviously... but the question is... is there any hope? Does anyone know any method, or tools (Linux, Windows, whatever) that can be used to recover at least some of the data?
C.
Others have suggested a course of action and appropriate tools but I think no-one has indicated what exactly what you may be committing yourself to (and you may feel that you have better things to do in life :-) ). A quick glance at this suggests to me that the strongest probability is that you now have a rather large data jigsaw. How complex the jigsaw is will largely be dependant on how fragmented the drive is and how much of the FAT information has been lost. It looks as if you have completely lost the root directory entry points or root FAT entries which means the data is there but there is no information on how it is initially organised. The good news is that data recovery is almost certainly possible if damage is restricted to these areas (mainly because FAT is a very primitive file system), but the bad news is that it can be very time consuming to do that recovery. The tools identified will identify some parts of the jigsaw but you will probably need to rebuild and identify some files directly. If you have a backup restore from that, if not (apart from the obvious "why no backup?"), I hope whoever has asked you to do this is paying by the hour or this a small drive with relatively few large files. If it is your data this is a case of judging the time you spend putting the jigsaw together, against the time of rebuilding the data from other sources. Good luck... - -- ============================================================================== I have always wished that my computer would be as easy to use as my telephone. My wish has come true. I no longer know how to use my telephone. Bjarne Stroustrup ============================================================================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iEYEARECAAYFAki9MxQACgkQasN0sSnLmgKFBwCg3yDazV6b6iKyncQMOYRS+xb4 d8MAoKC+dnuenNSUUj2abh8TF7icK7Y2 =oPTR -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
If you have a backup restore from that, if not (apart from the obvious "why no backup?"), I hope whoever has asked you to do this is paying by the hour or this a small drive with relatively few large files.
Well, this drive was to be the backup. Short story is... it started with a friend's personal computer with way too much data. They are migrating all computers in the house to Linux which in their case means moving all data off to backup reformatting and repartitioning from FAT32/WinXP to Linux. The USB drive was to be the main backup once the migration was complete. In this case, data was moved, and the broken FAT was only discovered after the original disk was overwritten. So... unless by some chance there are duplicate copies of the same data on another drive, this is currently the only copy. Plan was to have the data on the PC hard drives, USB drive as the main backup, and a DVD RW secondary backup. We didn't get that far. :-( There are no other source to rebuild the data from.... C. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
On Tue, Sep 2, 2008 at 9:37 AM, Clayton
If you have a backup restore from that, if not (apart from the obvious "why no backup?"), I hope whoever has asked you to do this is paying by the hour or this a small drive with relatively few large files.
Well, this drive was to be the backup. Short story is... it started with a friend's personal computer with way too much data. They are migrating all computers in the house to Linux which in their case means moving all data off to backup reformatting and repartitioning from FAT32/WinXP to Linux. The USB drive was to be the main backup once the migration was complete. In this case, data was moved, and the broken FAT was only discovered after the original disk was overwritten.
So... unless by some chance there are duplicate copies of the same data on another drive, this is currently the only copy. Plan was to have the data on the PC hard drives, USB drive as the main backup, and a DVD RW secondary backup. We didn't get that far. :-( There are no other source to rebuild the data from....
C. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Guys, just a note since about a week ago, I posted almost the same question. That dd_recuse is worth looking at. It helped me recover 25Gigs, with only about 6 files lost. It very easy to use. This is a very good how to for dd_recuse and recovering a drive. http://blog.herbertm.ca/pages/badblocks-howto -- -- Command, n.: Statement presented by a human and accepted by a computer in such a manner as to make the human feel as if he is in control. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
If you have a backup restore from that, if not (apart from the obvious "why no backup?"), I hope whoever has asked you to do this is paying by the hour or this a small drive with relatively few large files.
Well, the drive autopsy was completed this past weekend. I tried using Autopsy, but that failed.. not because of the software, but because of the drive size. The drive with problems was a 750GB drive. Autopsy works on an image of that drive, and well... it's pretty hard to make a drive image of a 750GB drive when you don't have a second 750GB drive to image to. No worries. In the end simply running dosfsck kind of worked. It found a bazillion files with length errors, and EOFed them. The FATs were inconsistant... and a bunch of other issues. One file was totally unrecoverable, but the other 150Gb of files were at least somewhat intact. Of the 150GB of files (mostly videos) around 50GB were damaged, but still playable. The remaining 100Gb were perfect. So.. a reasonably successful recovery in the end. Thanks for the help and pointers. C. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
I can strongly recommend Runtime Software's GetDataBack product. I've
used both the FAT32 version and NTFS version. It scans the drive but
does not write to it at any point. For USD 90 it's well worth the
price, it recovered data on an NTFS drive that just one day said
"Volume is not formatted" better than OnTrack's $500 program (which
scanned and found nothing).
On Mon, Sep 1, 2008 at 2:18 PM, Clayton
I am working on trying to recover some data from a hard drive (FAT32 formatted). The drive can be mounted OK (mounted in a USB external drive housing), but the data is not accessible. When I do an ls -al, I get this back:
============================== /media/usbdrive> ls -al total 32 drwxrwxrwx 5 root root 16384 2008-06-21 17:28 ./ drwxrwxrwx 5 root root 16384 1970-01-01 01:00 ../ ?--------- ? ? ? ? ? Backup ?--------- ? ? ? ? ? Vids_1992 ?--------- ? ? ? ? ? Photos_1992 ==============================
So... something is seriously wrong... obviously... but the question is... is there any hope? Does anyone know any method, or tools (Linux, Windows, whatever) that can be used to recover at least some of the data?
C. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
-- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
Clayton wrote:
I am working on trying to recover some data from a hard drive (FAT32 formatted). The drive can be mounted OK (mounted in a USB external drive housing), but the data is not accessible. When I do an ls -al, I get this back:
============================== /media/usbdrive> ls -al total 32 drwxrwxrwx 5 root root 16384 2008-06-21 17:28 ./ drwxrwxrwx 5 root root 16384 1970-01-01 01:00 ../ ?--------- ? ? ? ? ? Backup ?--------- ? ? ? ? ? Vids_1992 ?--------- ? ? ? ? ? Photos_1992 ==============================
So... something is seriously wrong... obviously... but the question is... is there any hope? Does anyone know any method, or tools (Linux, Windows, whatever) that can be used to recover at least some of the data?
C.
Use Recuva, runs under windoh's and can be installed in a USB pendrive, enable deep scan I have recover almost all my files some time ago. Regards, -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org For additional commands, e-mail: opensuse+help@opensuse.org
participants (10)
-
Andrew Joakimsen -
Anton Moiseev -
Chuck Payne -
Clayton -
Cristian Rodríguez -
Fernando Costa -
G T Smith -
Joop Beris -
Joop Beris -
Verner Kjærsgaard