LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 01-15-2014, 06:46 PM   #1
vvvtdseqactvvv
LQ Newbie
 
Registered: Jan 2014
Posts: 2

Rep: Reputation: Disabled
Recovering files from repartitioned/reformatted drive with TestDisk/PhotoRec/Foremost


Long story short, my laptop was stolen, and I reacquired it a few days later to discover that Windows 8 had been installed over my Debian system. There was much emotionally important data on the HDD, and I'm looking to recover as much of it as possible. I have made an image of the drive to work with and have been researching how to use TestDisk, PhotoRec, and/or Foremost on it, but I'm unsure exactly how to proceed given my specific situation. The drive partition structure was totally changed during the Windows install, and I can't find much info on what to do in such a case.

Running testdisk on the image finds two current NTFS partitions, one bootable and one primary. Quick Search finds the Linux partitions that existed before the repartitioning/reformatting (a parimary bootable and a swap partition). I assume this is a good thing. But how should I proceed from here?

Any help appreciated. I have also made a thread on the cgsecurity.org forums, but it's taking forever to be approved and I thought I might have more luck here anyway.
 
Old 01-15-2014, 07:55 PM   #2
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,148
Blog Entries: 2

Rep: Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886
Testdisk will be of no use in your case, since the filesystem(s) on that disk will be destroyed due to the overwrite with Windows. You will have to use Photorec (I wouldn't recommend Foremost, it wasn't updated in about 5 years).
Use it on the image-file and let it search in the free space of the partitions. You may want to narrow down the search to the specific file formats in the File Opt menu, this will decrease runtime and the number of unneeded files. Since Photorec is a brute force file carving tool this will nonetheless take some time, it may be a good idea to use that time to think about a good backup strategy to prevent incidents like that in the future.
 
Old 01-15-2014, 08:21 PM   #3
vvvtdseqactvvv
LQ Newbie
 
Registered: Jan 2014
Posts: 2

Original Poster
Rep: Reputation: Disabled
Oh trust me, I've taken a good lesson from this.

But about using PhotoRec, I'm not sure I understand. You're saying I should just go ahead and search the free space of the current NTFS partitions? There's an option to use the whole disk instead. Should I do that instead? Or does it matter? Does the partition structure even matter at this point?
 
Old 01-15-2014, 09:13 PM   #4
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,148
Blog Entries: 2

Rep: Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886Reputation: 4886
Using the whole disk does not make much sense, those parts that are not marked as free only contain parts of the Windows system and you surely don't want to recover that. Concentrating on the free space, those parts that are not overwritten by Windows anyway, will reduce the time for the recovery action and, more important, reduce the amount of found files that are useless.
The largest part of a recovery job with low-level file carvers like Photorec isn't the actual file carving, but you sitting down and looking through all the found files, sorting the good from the useless. I have done some of those recovery actions for friends (all of them bought external harddisks for backups immediately afterwards) and the results were astonishing. People who had about two thousand photos on their harddisk had to find them between 60.000 images that were carved from the disk. Keep in mind that low level carvers in most cases will not recover filenames. So while with a good file manager you can take a look at the thumbnails of those images to get a first impression which may be useful and which not, I also had a friend for whom I had to restore a MP3 collection. Imagine playing thousands of MP3s to find those you are interested in.
Believe me, you will keep the ratio of important files/found files as high as possible, by all means. So, don't include parts of the disk that can't hold your files anyway (because they are overwritten), use the File Opt menu to only search for files that you know are relevant, and so on. If you happen to search for more common formats, like PNG, JPG or even plain text files, you will literally get thousands of files to search through.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
removed all the files from /home folder.tried recovering with foremost.xsession erro harif.konndeth Linux - Newbie 6 09-16-2010 06:48 AM
recover directories & files from ext. HDD using testdisk or photorec esteeven Linux - Hardware 1 11-13-2008 10:48 AM
Recovering files from reformatted FAT in linux ensa Linux - General 6 07-22-2007 04:25 PM
Recovering data from repartitioned ntfs drive booyabazooka Linux - Software 2 09-20-2004 10:37 PM
Recovering NTFS partition off repartitioned hard drive jhayden Linux - Hardware 3 08-30-2004 10:51 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 01:27 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration