well, I hope someone who will read this tread, will be a bit more clever and will have a little bit more knowledge than I do.

anyway, when dd_rescue stopped, I was not sure what to do next. I did not have testdisk installed, and did not clearly understood how to try to mount rescued dd file. then computer did not want to unmount new hdd and old hdd, when I used right click and unmount, so I used umount .

By the way, as far as I knew Linux is very stable system, but at some point computer started playing funny, it would not let me do screenshots, or upload anything from usb stick, it did not freeze or something, but I had to restart it, and everything became fine (reminded old Windows I used )

I managed to install testdisk: apt-get install testdisk
I had to connect internet first and installation process took a minute or less.

My next plans as unSpawn explained in post 41:
1.try to mount dd file
2.photorec (as most of data I want to save are jpeg.)
3.may be try to fix and mount faulty drive, or send it back to Freecom (where I bought it from last August, so still under warranty).

this bid did not work, as unSpawn suspected!
"mount /dev/loop0 -t vfat /mnt/recovery -o ro" (I used mnt/recovery)
showed errors, and "dmesg" showed a lots of everything what does not really make sense to me, but I saved it in text file just in case. The only thing I understood was last line:

[ 442.440882] VFS: Can't find a valid FAT filesystem on dev loop0.

so next step - photorec

now I cannot unmount hard drive, it's /dev/sdb1 on /media/disk

starwood@starwood-laptop:~$ umount /media/disk
/sbin/umount.hal: Unmounting /media/disk failed: org.freedesktop.Hal.Device.Volume.Busy: umount: /media/disk: device is busy
starwood@starwood-laptop:~$ umount /dev/sdb1
/sbin/umount.hal: Unmounting /dev/sdb1 failed: org.freedesktop.Hal.Device.Volume.Busy: umount: /media/disk: device is busy


all applications are off

ok, did it using "umount -l /media/disk"

If a drive is busy you have to find out what is still running, it may be a 'process' or an 'application' such as konqueror or nautilus that is still listing the contents of the drive.

If it is a process then it may be found (sometimes) by running (as root or sudo) the command: ps aux | grep sdb1

or: ps aux | grep media

these commands return a 'pid' number which can be killed by root : kill XXXX (where XXXX is the process id returned by the ps aux command

If this does not work you can manually edit /etc/fstab (again as root) using an editor such as gedit - just delete the line that starts /dev/sdb1 - save the file - and exit

Hope this helps

did that, after more than 8 hours:

PhotoRec 6.8, Data Recovery Utility, August 2007
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /media/disk/sdc2.dd - 499 GB / 465 GiB (RO)
Partition Start End Size in sectors
D empty 0 0 1 60784 83 63 976500252 [Whole disk]


3009 files saved in /media/disk/undelete directory.
Recovery completed.
jpg: 2977 recovered
mpg: 26 recovered
asf: 6 recovered

sounds promising
so, I do Quit
and open Hard Drive, I can see 8 undelete folders
first one undelete, rest undelete.1 ***.2 ***.3 ... ***.7
the first folder is empty
the rest, when I try to open:

The folder contents could not be displayed.
You do not have permissions necessary
to view the contents of ***

what's wrong now??? how do I get permissions?

or how do I copy folder from one hard to another using terminal?

Photorec needs to run as root and lesser-privileged users are by default not allowed to access files that are owned by other user Ids. That's not a problem but actually one of the strengths of UNIX-like OSes. If the unprivileged user Id you use is named "d1mkaz" you could recursively change permissions of the /media/disk/undelet* directories and files: 'chown -R d1mkaz.d1mkaz /media/disk/undelet*'.


As root user run 'cp -r /media/disk/undelet* /path/to/other/disk/' where "/path/to/other/disk/" is the mounted directory name on the other disk.


* BTW, don't forget to read http://www.cgsecurity.org/wiki/Advanced_FAT_Repair as testdisk might still be used to inspect file system contents and rebuild the FAT.

Thank you unSpawn again.
I managed to see what is inside undelete folders by "gksudo nautilus"
it's easier for me, as I get used to graphical interface.
I did not had time to copy files yet, but one thing is a bit worrying.
when photorec finished, this was the conclusion:

3009 files saved in /media/disk/undelete directory.
Recovery completed.
jpg: 2977 recovered
mpg: 26 recovered
asf: 6 recovered

so 2977 files jpeg saved, if file size between 2MB and 3MB
then it should be around 8000MB what makes it 8GB,
I had about 40GB of pictures, does it mean I lost the rest? 30GB will never recover?
That is really really sad!

Photorec is a header / footer file "carver" and carving isn't too subtle a process. There's no guarantee when it comes to file recovery. The amount of time you kept working on the machine after the umount error may have allowed for more filesystem corruption as well. It's just not good ignoring that kind of errors. Finally we just don't know the condition of the file-system on the "victim" partitions image, plus you haven't told us what options or settings you used for recovery. So I wonder if you're drawing conclusions too hastily or not. (BTW I'm not going to point you at testdisk again.)

to be fare, dd_rescue did the job, photorec did the job,
so I would always recommend this way to everyone who has
problems with unmountable hard drives.

Or may be someone will try PTrenholme suggestion in post Nr.36.

But anyway, I highly recommend
TO DO BACKUPS, of important data.
that should save time, money, and nerves.

You can still take it to a professional recovery service.

conclusion for my situation:

As I said in the beginning, something happened to hard, and it's stopped mounting on mac os x (1tb - 2 partitions 500GB Fat & 500GB Mac journaled, problem with Fat32). This tread dedicated to that problem.

I said as well, that I can mount the FAT32 partition under Knoppix (from CD) , there is Knoppix from CD or from DVD available on in-net, it's free, and it works ! The only thing you have to do is burn CD or DVD with Knoppix, and then restart computer with CD or DVD in it, and when starting hold "C" , so it boots from CD or DVD (MacBook Pro)

So, after all the trouble I went (it's all on this tread) , I went back, and mounted FAT32 under Knoppix. I was able to open the FAT32 partition and see folders. Opening took some time, it looks as it freezes and I was patient and waited for some time, not pressing any buttons, and there was "loading" message on screen forever, but at the end it did open! When I was able to see folders, I went for the one important to me, and opened it the same way (another 5-10min waiting). I have to say, that I did sort all the folders in order before crash, so when I opened, lets say folder "pictures" , inside there where A, B, C, D, etc ... folders. I marked folder "A" (in Knoppix, it's just pointing mouse on folder). Marking folder actually took another 5-10 min. But when it was marked, copy/paste did the job. Copy/Paste is another waiting story, you leave it overnight, and next morning you see 10% or more if you lucky, moved to another (healthy) hard drive. Or sometimes you can get Error message, that happened to me once, then you probably cannot do anything about it.

P.S. several folders had ? mark at the end of the name, those I was not able to move.

All this you do usually, unusual stuff is time. You have to wait. Sometimes it takes really long. But if info you getting is important, then time is not a problem.
The last 3 or 4 weeks I was working on it. At the moment I did get about 40GB of data (sorted data not mess as I had with photorec). Unfortunately it is not the end yet, but fortunately it works, and hopefully after another couple weeks, I'll have all my data back which I thought was lost for good.

It was said earlier, that doing so can damage Hard Drive even more, and I cannot comment on that, but in MY situation, it did work, and even If I did damaged HDD more, I did get a lot more from it this way than I did using terminal and different tools. As I said before, those tools did the job, and thanks to everyone who helped me. But I found the way it worked for me more efficiently.

Hope that helps.