Recovering Data After Disconnecting External HD Without Unmounting

dsschanze · 11-11-2012, 08:05 AM

This morning in haste, I stupidly disconnected my external HD from my laptop and as a result some of my files that had just finished copying have gone missing. While the files I lost are not super critical to get back - it would be nice to be able to retrieve them. Is an application such as Photorec the easiest way to attempt their retrieval or is another application more suitable. Also it appears that space is being taken up by these files on my external HD - is there a way to reclaim this space?

Thanks!

unSpawn · 11-11-2012, 10:03 AM

Quote:

Originally Posted by dsschanze

This morning in haste, I stupidly disconnected my external HD from my laptop and as a result some of my files that had just finished copying have gone missing.

In short syncing didn't complete and as a result the files weren't written completely.

Quote:

Originally Posted by dsschanze

While the files I lost are not super critical to get back - it would be nice to be able to retrieve them.

You referred to "copying" which in contrast to moving means the original is still available. That being the case I wouldn't bother with recovery.

Quote:

Originally Posted by dsschanze

Is an application such as Photorec the easiest way to attempt their retrieval or is another application more suitable.

Photorec, Scalpel and Foremost all can or can't make heads or tails of it but IMHO something being suitable depends on an understanding of the tools and the situation. Think files that are incomplete anyway, files that don't have proper header / footer signatures or an OP forgetting to mention he compounded the situation by already having run fsck or copied files over or something like that. Whatever you intend to use do read the manual, set the victim drive read-only, decide if you need to make an image of the drive or can live without it and always recover to a physically different medium.

Quote:

Originally Posted by dsschanze

Also it appears that space is being taken up by these files on my external HD - is there a way to reclaim this space?

Running fsck on the medium should fix file systems problems if any and correct the file systems state (dirty > clean). If after that space still doesn't seem to be reclaimed you could zero out free space by dd'ing /dev/zero to a file on the medium.

dsschanze · 11-11-2012, 10:14 AM

Quote:

Originally Posted by unSpawn

In short syncing didn't complete and as a result the files weren't written completely.

You referred to "copying" which in contrast to moving means the original is still available. That being the case I wouldn't bother with recovery.

Photorec, Scalpel and Foremost all can or can't make heads or tails of it but IMHO something being suitable depends on an understanding of the tools and the situation. Think files that are incomplete anyway, files that don't have proper header / footer signatures or an OP forgetting to mention he compounded the situation by already having run fsck or copied files over or something like that. Whatever you intend to use do read the manual, set the victim drive read-only, decide if you need to make an image of the drive or can live without it and always recover to a physically different medium.

Running fsck on the medium should fix file systems problems if any and correct the file systems state (dirty > clean). If after that space still doesn't seem to be reclaimed you could zero out free space by dd'ing /dev/zero to a file on the medium.

Thanks for the suggestions...I did make a mistake in my original post - I was moving the files not copying. I'll take a look at the manuals of the different apps.

You mention that fsck will fix the any file system problems - will this fix problems on an NTFS medium or only ext3/4 filesystem?

unSpawn · 11-11-2012, 10:54 AM

Quote:

Originally Posted by dsschanze

I'll take a look at the manuals of the different apps.

You'll probably find Photorec to be the easiest to use with the largest amount of ready-made signatures. Note its companion app 'testdisk' can be used to have a "Live view" of the victim disk: umount the partition or remount it read-only then point testdisk at it, for example 'cd /tmp; testdisk /debug /log /dev/sdc1' and then you can "browse" the file system: ( Proceed > Choose partition table type ("none" if mounting a partition) > Advanced > Undelete).

Quote:

Originally Posted by dsschanze

You mention that fsck will fix the any file system problems - will this fix problems on an NTFS medium or only ext3/4 filesystem?

Just to be clear: do not, I repeat, do not run fsck on partitions you still have to recover items from. Next to overwriting files it's the best way to fsck up a file system further. The best tools for any file system are those that are native to the system: NTFS specs aren't exactly secret and NTFS-3g works well enough to perform write ops w/o problems but ntfsfix isn't a "fsck for NTFS" and the manual says that too.