Advice on recovering an NTFS filesystem please
My daughter was copying files over the network from her old computer (Win2K) to her new one (WinXP). Unfortunately she elected to use Cut and Paste rather than Copy and Paste. All her music files vanished from the old disc and did not appear on the new one.
I put the old disc (40GB ATA partitioned into 4 partitions, all NTFS formatted) into a Debian machine thinking to use ntfsundelete to recover the files. However the disc cannot be mounted and fdisk comes up with the partition table blank. Examining /dev shows that /dev/hda exists but there are no entries for hda1-4. When I put the disc back into the Windows machine it refused to boot. Partition magic reports the first partition to be unformatted but can see the other three. The lost files are (were) on the second partition and apparently only the d:\music directory was lost. My question: How best can I get to mount the drive? If I recreate the lost partition will I lose data? Can I create /dev/hda2 manually? Advice gratefully received. Teenager is devastated by her loss. |
can you use partition magic's undelete feature?
i dont know but i wouldnt think creating a new partition would remove the old stuff, but i dont know if that would find it either. if you _need_ the data that was on it i would take it to a professional and see what they can do. now a days with high speed internet if she just had music (not important documents, etc) then i would say just format it and download them again. |
Partition Magic is not offering undelete on this disc. I assume that the corruption extends to not indicating that there was data on partition 0.
Yes, one could reformat etc but not until I've tried everything else. Next time I meet this problem it could involve vital data - and how many Windows users perform backups? |
Try Acronis Recovery Expert, it has a powerful undelete feature.
You can try to recreate the partition, but then it needs to be identical with the one that was there - otherwise you risk overwriting the info about the files on the harddrive. mARGO |
You say "ATA", I am assuming "IDE", but unfortunately "ATA" is becoming ambiguous. Unwillingly, I am beginning to think we must always say either "SATA" or "PATA" to avoid confusion.
Can you confirm the part. table is indeed blank (w/ the prob. drive in a GNU/Linux box): Code:
dd if=hdx bs=512 count=1 |hd |less |
You're quite right, the drive is PATA. Unfortunately(?) I have got into the habit of using IDE and SATA. Reply to the question will be later this evening, when I get home.
|
This is the hex dump of my problem disc's boot sector. I don't know enough to interpret the partition table though:confused:.
Code:
00000000 33 c0 8e d0 bc 00 7c fb 50 07 50 1f fc be 1b 7c |3.....|.P.P....|| Code:
dd if=/dev/hda bs=512 count=1 |hd > mbrdump ntfsundelete found the missing MP3s So without further ado I'm going to ntfsundelete the drive. Still would like to know if the Partition table is corrupt though. |
Moved: This thread is more suitable in General and has been moved accordingly to help your thread/question get the exposure it deserves.
Mod note: Windows questions are better suited for the General forum. |
I posted this as a Linux question. Windows trashed the disc. I don't trust Windows utilities to to fix it. Hence my posting here.
In fact, Linux fixed the problem in that I have recovered the files with ntfsundelete. However I would still appreciate input on the interpretation of the dump of the MBR and how to recover the first partition. The next time I encounter this problem it might be on more valuable data. |
You may use testdisk at http://www.cgsecurity.org/wiki/TestDisk to recreate the partition table. I bet there are other GPL tools. Gpart at http://www.stud.uni-hannover.de/user/76201/gpart/ saved my life once. Why not backup the disk with dd as it is so you can try different approachs ?
|
If I might make a suggestion, rather than fiddling about it yourself and risking wiping out or overwriting the raw data on the disk, I would suggest taking it to a professional data recovery expert.
It might cost a bit, but the end result might be well worth it... |
This may be the explanation you're looking for:
http://www.win.tue.nl/~aeb/partition..._tables-2.html "Unwrapping" your posted MBR, your part. table is: Code:
* If you can at least mount that 1st part., you can dd it into a file & then mount the result via the loopback interface. |
Testdisk recovered the partition in the sense that it now shows up in fdisk.
Code:
Disk /dev/hda: 40.9 GB, 40982151168 bytes Code:
davcefai:/home/david# mount /dev/hda1 /mnt/taradisc -t ntfs Code:
davcefai:/home/david# dmesg|tail Luckily the disc failed at the least critical time. Lecture notes etc were copied over OK. I'll post again with any test results in case anybody will find them useful in future. Thanks to all who contributed. |
All times are GMT -5. The time now is 12:49 PM. |