Question Filesystem recovery

Toggle sidebar Toggle sidebar
C

cube10025

Distinguished
Sep 6, 2016
28
0
18,530
Did something stupid, wanted to reinstall Win 10 instead of picking my USB stick I formatted and installed on my USB HDD backed up with all my longtime data, Plex and files. (My server was temp down)

I was able to save most of the files but some are with dynamic names, want to restore the files system.
I have copied the drive to an image file and run test disk, but I can not find the file system. It dose show me files with in. Exempel old mac boot drives, see img below.

Dose anyone knows of a software that can restore a file system. Tested disk drill and testdisk.



testdisk.jpg
 
Sort by date Sort by votes
cube10025 said:
Dose anyone knows of a software that can restore a file system.
Click to expand...

If the data on your HDD is valuable, i'd contact data recovery firm and pay them a hefty sum for data recovery. Since they have specialized tools to recover the data.

Using (free) software, for the most part, doesn't help. If lucky, you may recover some, but not all. Hence why data recovery firms exist. Since when you could recover all your data with (free) software on your own, all data recovery firms would've been out of business a long time ago.

cube10025 said:
Did something stupid, wanted to reinstall Win 10 instead of picking my USB stick I formatted and installed on my USB HDD backed up with all my longtime data
Click to expand...

Besides you butterfingering and making this obvious mistake, what stopped you to unplug all other drives beforehand? So that kind of mistake wouldn't be possible? And it's not like you had your HDD installed in a system, where you needed to open the system, find the power/SATA cable to unplug the drive from the rest of the PC. You had your HDD connected with USB. One single cable, outside of PC to pull out.

Life lesson: When installing Win, disconnect all other drives beforehand, leaving only OS drive connected.
Life's tax: Data recovery must be done properly and thus - is expensive.
 
Upvote 0 Downvote
Aeacus said:
When installing Win, disconnect all other drives beforehand
Click to expand...

Not install Win, The windows install USB. But your right.
Of course you can use free software, Linux is opensource. The data is already saved, I do not want to go over every filename and rename them. That is why I am looking for filesystem rebuild. Gparted can guess the file system but takes forever on 4tb.
 
Upvote 0 Downvote
cube10025 said:
Gparted can guess the file system but takes forever on 4tb.
Click to expand...

When you mess up and overwrite important data, file recovery isn't fast nor easy. So, if Gparted can recover your data on your GNU/Linux system, i suggest you let it run, while patiently waiting when it finishes.

Let me ask you this, which of the two is preferred for you:
  1. Wait until Gparted finishes the recovery.
  2. Pay easy 1000+ bucks for data recovery firm to recover your data.
🤔
 
Upvote 0 Downvote
cube10025 said:
What is with the contrarian posts!?
Click to expand...
We're just trying to determine the extent of the damage.

But, considering this drive was completely reformatted to FAT32, and the Windows install data was written to it, there is almost no possibility of 100% data retrieval, and especially not in the original 'file structure'.

A lot of it was actually totally overwritten. No longer exists.
 
  • Like
Reactions: ex_bubblehead
Upvote 1 Downvote
USAFRet said:
A lot of it was actually totally overwritten. No longer exists.
Click to expand...

On an HDD, technically it exists (data can be recovered even when up to 20 rewrites has happened) but only one who can recover it, are data recovery firms with special knowledge and special tools. And it will cost A LOT. Small fortune if recovery is in moderate difficulty, but an arm and a leg + then some, if recovery is difficult. Of course, there is no guarantee that 100% of data can be recovered.
 
Upvote 0 Downvote
Aeacus said:
On an HDD, technically it exists (data can be recovered even when up to 20 rewrites has happened) but only one who can recover it, are data recovery firms with special knowledge and special tools. And it will cost A LOT. Small fortune if recovery is in moderate difficulty, but an arm and a leg + then some, if recovery is difficult. Of course, there is no guarantee that 100% of data can be recovered.
Click to expand...
"some data", maybe.

A single small text file. Or pointers to an email address.
The entirety of a several GB video? Not a chance.

And with "cost a lot"....FBI/NSA/GCHQ level recovery.
Like, if this drive was the only known container of plans for a working cold fusion reactor.
 
Upvote 0 Downvote
Aeacus said:
but only one who can recover it, are data recovery firms with special knowledge and special tools
Click to expand...

Well that is on not the case here, 8gb on 4tb hard drive. The issue is not the data is the restructuring filenames.

I was looking for some input on testdisk or other recovery software. Why are you cluttering the forum with irrelevant posts?
 
Upvote 0 Downvote
cube10025 said:
Well that is on not the case here, 8gb on 4tb hard drive. The issue is not the data is the restructuring filenames.

I was looking for some input on testdisk or other recovery software. Why are you cluttering the forum with irrelevant posts?
Click to expand...

I'm assuming that the drive was originally formatted as NTFS (despite the Mac OS stuff). If so, then the $MFT would have been overwritten. It normally resides at the 3GB - 4GB point. The $MFT contains a record for every file on the drive. These records store the file's metadata, ie filename, creation date, size, location, etc.

In short, no data recovery tool can recover the original file/folder tree because it has been totally overwritten. The only exception is if the $MFT was fragmented, but that usually only happens when you have zillions of files.

This is about all you can do:

https://www.cgsecurity.org/wiki/After_Using_PhotoRec
 
Upvote 0 Downvote
Lafong said:
You might get some info at the above link. I don't know how accurate it is.
Click to expand...
I will try this! Thanks!

fzabkar said:
The $MFT contains a record for every file on the drive. These records store the file's metadata, ie filename, creation date, size, location, etc.
Click to expand...

Yes I guess, but its weird some file have there names. look at the recovered files.
testdisk3.jpg

And then I got this mess
testdisk4.jpg
 
Upvote 0 Downvote
It looks like the $MFT may have been fragmented, or perhaps the $MFT was not located in the default location. You could try scanning your image file with DMDE.

https://dmde.com/

The search results will show the recovered $MFT fragments. You don't need a raw scan (because you already have those results).

Edit:

Actually, DMDE should find the copy of the original NTFS boot sector at the end of the volume. The metadata in the boot sector will tell us where the $MFT was located. This info should be available within a few seconds under the Partitions tab.
 
Last edited:
Upvote 0 Downvote
USAFRet said:
It doesn't count until the actual files exist on a different drive and are fully playable.

"file000843.mp4" is simply a file fragment.
Click to expand...

It may actually be a complete file, but it has been carved. Therefore, it may indeed only contain the first fragment (plus junk), and consequently it may not be completely playable.

That said, if the original file was unfragmented, then the carved file should be intact.
 
Upvote 0 Downvote
fzabkar said:
It's actually a complete file, but it has been carved. Therefore, it may indeed only contain the first fragment (plus junk), and consequently it may not be completely playable.

That said, if the original file was unfragmented, then the carved file should be intact.
Click to expand...
Right...a "file", but maybe not the actual total original video.
And at 125,371 kb, unlikey that is the whole original vid.
 
Upvote 0 Downvote
fzabkar said:
It looks like the $MFT may have been fragmented, or perhaps the $MFT was not located in the default location. You could try scanning your image file with DMDE.
Click to expand...

Some update, was not able to recover the partition but DMDE was able to find a lot more files if not all. It´s raw data but it still has the Title so just need to rename them after that. Thanks for the help fzabkar
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom