Need help with data recovery
A crap JMicron USB controller messed up my backup drive, and I can't recover it with testdisk. It was an 80GB NTFS partition on an 80GB drive, but testdisk cannot recover it - it appears to be a 160GB file. Is there any way I can manually edit the deleted volume size to be 80GB?
ThinkPad T400
I imagine you tried using something like Knoppix or Bart PE to see if the drive will mount? There have been times on a fuxored drive I left Knoppix running on it all night and the drive finally mounted, after about 4 or 5 hours. That would be a good place to start. If you can actually get it mounted, maybe move the data little by little, or if your brave enough, image it, then run the recovery on the image
Before you do anything, can I suggest that you do nothing and just stop for a second and think about how valuable the data is.
If the data is very valuable, I wouldn't go near the drive, I'd kill the power straight away and go to see someone who specialises in data recovery.
Of course though, if the data isn't too important, you can try recover it yourself, but be warned that this all-too-often leads to disaster.
About a year or two ago, I backed up all my personal stuff onto a CD-R. I was stupid enough to wipe my hard disk without first checking that the CD-R burned correctly. That day I ran around trying the CD in about 10 different computers, no joy.
I still have that CD-R, I suppose I'm hoping that some day, some where, somebody will be able to read from it. (Actually right now I'm gonna go try it in a Bluray drive).
Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".
It isn't too important, just convient to have. Since testdisk was complaining about disk size, I went ahead and made a copy of the 80GB drive onto an empty 200GB drive I had laying around. So if anything happens, I still have a copy. The next problem is that when the FS is restored, it structure is bad, and it isn't in the right location. Instead of being in the first 74.53GB, it appears taking up the second 74.53GB. This is what I mean:
The data is on the first portion of the drive, while the filesystem is elsewhere. Can I manually change the filesystem's metadata so that it is in the right location?
ThinkPad T400
It may be that only the partition record is messed up, but the actual data is still present.
I would highly recommend BootMaster Plus:
http://bootmaster.filerecovery.biz/i...FRSO1Qodh17TrQ
You can use this as a demo version, to verify for free whether or not it can successfully rebuild your mbr, etc, then only purchase a license if it is going to be of use to you. A great idea, imho.
I have used this program to reconstruct mbr's quite a few times, saving a lot of hassle and lost data!
Failing that, a decent file recovery program that will recover *raw* data would be worth a try.
But I would look at the mbr first.
Good luck.
Give R-Studio a try. Its a windows utility, but it is very successful in recovery.
William
I just wonder.....what to do when your system (windows/linux) doesn't even recognize the hard drive anymore...which happened to me a few months ago? Is there still a way to rescue the data on it since all tools mentioned in this thread will probably not work in that case
Well, I am not talking about professional companies earning a big money with data recovery/rescue - they surely can do it.
Don't eat yellow snow :rolleyes:
I saw a great talk at last years Toorcon about about data recovery. Your best bet is to search ebay for an identical drive. If you can find one, you may be able to swap the circuit boards and get your drive working again. Make sure the boards have the same brand of logic chips.
William
This was /.'ed today. It's pretty interesting.
http://datacent.com/hard_drive_sounds.php
A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.
There is no mechanical errors, it is entirely software issue. The problem is that the partition location is in the wrong position. I don't need to undelete the partition, I need to edit the location where the location of the parition is. In the picture I posted above, the data is located in the front of the drive, while the partition is located after the data. It is like partition start was changed to where the end was, as the original drive was 74.53GB. I can't explain how it happened, I unmounted everything, and always performed clean shutdowns.
ThinkPad T400
Posting Permissions
