LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 10-18-2009, 12:22 AM   #16
jarnos
LQ Newbie
 
Registered: Oct 2009
Posts: 7

Original Poster
Rep: Reputation: 0

Quote:
Originally Posted by unSpawn View Post
Personally I wouldn't run anything on an image copy that would disturb (e.g.: reorder, rearrange, orphan) anything in the image. Filesystem structures just are too fragile. A quick and dirty way to match recovered files in PhotoRecs recup dirs could be to compare hashes with files from a backup. The next step would be to run the same but in small chunks running say 'sha256deep' in piecewise mode. Below that level you should realise that the header/footer carving process isn't infallible due to indirect inode usage and that using dd_rescue (which can also read from the end of the disk back to the front) or ddrescue, when confronted with the "click of death", will result in a very small recovery rate even before you start recovery.
Thanks for all the advice. The image copy I would compare with is a second copy of an image already backed up and would be mounted as a read-only virtual drive to avoid altering it.

I'm making a few copies of the PhotoRec output before I start looking more closely. Not all of the files are intact, but from a random sampling, more of them seem to be readable than the filesystem that resulted from CHKDSK. Even for the files that are not readable, I haven't found any that are completely full of 00 00 00 00 ... like many of the files from CHKDSK. CHKDSK seems to have tried to create many files out of thin air using the file index data, without actually connecting it to the file.

I have found some oddly recovered files though, where the top of the file is a few hundred KB of an image or document, then the rest of the file is filled with random fragments of data, so the few hundred KB image is embedded at the top of a file tens of megabytes in size. On the other hand, I have also found some videos that should be hundreds of megabytes, but are split into many smaller segments.

After backing up these files, my next step is to go through some of the CHKDSK files that are zeroed out and see if I can find any of them intact in the PhotoRec output.
 
Old 10-21-2009, 01:06 AM   #17
jarnos
LQ Newbie
 
Registered: Oct 2009
Posts: 7

Original Poster
Rep: Reputation: 0
Well, I am getting some good results out of PhotoRec. I found a few more files that I was looking for that had been zeroed out by CHKDSK. In one case, a .zip file was split into 5 different randomly named zip fragments, but I found this Windows tool and was able to extract 80-90% of the files:

http://www.diskinternals.com/zip-repair/

So, PhotoRec has helped pull a bit more data out of the corrupted drive image, although sorting through the files is a chore. Many of the output files are randomly split into different fragments or multiple files are combined into one file, so there's a lot of manual searching and binary carving needed to get to certain files.

I have also been digging through my old backups and was able to find some more of the lost files that neither ddresuce/CHKDSK nor PhotoRec had been able to recover.
 
Old 10-22-2009, 04:20 PM   #18
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by jarnos View Post
So, PhotoRec has helped pull a bit more data out of the corrupted drive image
Good to hear. Well done!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Data recovery - photorec vs. testdisk vs. ddrescue? JStevenson Linux - Newbie 7 09-01-2009 03:27 PM
seg fault / mem fault - in cron, but works in shell? kauaikat Red Hat 1 04-29-2008 04:24 PM
Two threads somehow using the same data (seg fault with pthreads in c) fortenbt Programming 9 04-25-2008 12:34 PM
Help! Data Recovery - NOT a partition fault - ext3 carthaginian Linux - Newbie 0 10-16-2004 09:13 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 02:21 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration