Folder gone missing on HD with all files in it! Recovery possible?

kayasaman · 05-03-2010, 05:56 PM

Hi,

I have an external 2.5" eSATA drive which up till now was using via USB2.0 connection and was working perfectly. The drive is pretty new - I think less then a year and it's a Seagate too of which I think to be more reliable although still consumer based.

I had connected the drive to FreeBSD 8.0 32bit on my server in ReadOnly mode using ext2fs in order to stream the information across my network.

Plugging the drive into Linux recently yielded everything performing fine, as the drive stores all the seasons of a TV show I started recognizing that things where outa whack when the linearity of the episodes stopped being sequential and previous episodes started playing when clicking an incremented episode.

The drive is formatted with the ext3 filesystem and I have already attempted to run e2fsck -p on it which showed up as the drive being 'clean'....

I then attempted to use my notebooks eSATA Express card to connect the drive via the eSATA cable as I have found it to be more reliable then the USB2 / ext3 solution which I've had my fair share of problems with.

The current output of the drive is as so:

Code:

/dev/sdb1             184G   86G   89G  50% /mnt/eSATAI

and the output of the directory where the TV show is comes up with one folder missing and instead classified as a file:

Code:

-rw-r--r-- 1 kaya kaya 2046682574 2009-09-13 07:06 Battlestar.Galactica.Season.1.720p.x264

Is there anything I can do to recover this information as I haven't written or deleted anything from the drive so I suspect the data is still there??

However, the drives TOC or Journal maybe damaged by whatever reason so I will need to repair that!

I stumbled across Magic Rescue and so far have compiled it but not used it as I wanted to be sure first if there was another way to do this.

Can anyone help me at all??

Many thanks!

kayasaman · 05-03-2010, 06:04 PM

I forgot to mention that the files within the directory are mkv format and small HD meaning 720p, of size roughly 4.8GB each...

I hope someone can help me recover them!!

smoker · 05-03-2010, 08:17 PM

It doesn't look good. The filesize is less than 2GB and if you are missing 13 episodes at 4.8GB each, then they seem to have disappeared. Is there a lost+found folder on the drive ?

kayasaman · 05-03-2010, 10:55 PM

Quote:

Is there a lost+found folder on the drive ?

There is but it's empty unfortunately :-(

kayasaman · 05-04-2010, 09:01 AM

Ok well....

there has been some progress but not to the extent of recovery!

Baically I found this page:

http://www.linux.com/archive/feature/126525

which gave me a few tools to use to analyze the disk.

The best one is probably the Sleuth Kit as it's meant for forensic analysis, although I have got some results with Foremost.

Foremost at least manages to detect the files although in the wrong format WMV.

The only tiny problem now is that my root partition seems to be full and I can't work out for the life of me where the informaiton has bombed out on me. I'm guessing /proc but I can't be sure:

Code:

# du -sh *
7.9M	bin
68M	boot
0	cdrom
264K	dev
15M	etc
du: cannot access `home/kaya/.gvfs': Permission denied
72G	home
0	initrd.img
0	initrd.img.old
567M	lib
11M	lib32
0	lib64
16K	lost+found
8.0K	media
23G	mnt
40M	opt
du: cannot access `proc/5797/task/5797/fd/4': No such file or directory
du: cannot access `proc/5797/task/5797/fdinfo/4': No such file or directory
du: cannot access `proc/5797/fd/4': No such file or directory
du: cannot access `proc/5797/fdinfo/4': No such file or directory
0	proc
1.4G	root
9.6M	sbin
4.0K	selinux
4.0K	srv
0	sys
55M	tftpboot
12K	tmp
7.1G	usr
416M	var
0	vmlinuz
0	vmlinuz.old

Doesn't add up to 33GB which is my /

Code:

# find . -size +1G
./home/kaya/Videos/Ghosts.of.Mars.2001.DVDrip.AC3.xvid-Shitbusters.avi
./home/kaya/.VirtualBox/HardDisks/trixbox.vdi
./home/kaya/.VirtualBox/HardDisks/OpenSolaris.vdi
find: `./home/kaya/.gvfs': Permission denied
./home/kaya/ISO/sol-10-u8-ga-x86-dvd.iso
./home/kaya/ISO/CentOS-5.4-i386-bin-DVD.iso
./home/kaya/amule-dl/zerrin ozer - full albumleri by basoda.rar
./home/kaya.tar
./proc/kcore
find: `./proc/5430/task/5430/fd/5': No such file or directory
find: `./proc/5430/task/5430/fdinfo/5': No such file or directory
find: `./proc/5430/fd/5': No such file or directory
find: `./proc/5430/fdinfo/5': No such file or directory

Interesting... what is /proc/kcore and also the 5430 folder too which seems to be an active running process or so - reboot didn't help!

Code:

# df -h
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda2              33G   32G     0 100% /

??? since du didn't detect it I can't work this one out!

[Edit]Quick addition to a link to use Foremost:

http://tombuntu.com/index.php/2008/0...with-foremost/

http://elysium.binaryparadox.net/art...-with-foremost

kayasaman · 05-04-2010, 09:16 AM

Quote:

This command causes Foremost to create a directory called output and put every file it can recover in. This could take a while.

Whoops, ok I found out where the space went:

Code:

:/mnt# du -sh output
23G	output

Luckily 1 problem solved! :-)

Now to the original one.... :-(