Linux.com

Data recovery Help!

Link to this post 14 May 09

A friend of mine has a "MyBook" portable HDD full of valuable photos, and other stuff.

He lent it to a friend of his and when he got it back he was not able to open it on his windows PC so he asked me for help.

When I got my hands the HDD, the first thing I did was to connect it to my Ubuntu machine.

To my surprise the HDD was readable. The thing is that the disk had 133MB worth of Time machine configuration files for a MacBook pro.

So, i'm thinking that this friend formatted the drive accidentally to HFS. :(

Is there any chance of recovering the info? Any idea on what program I should Use?

Link to this post 14 May 09

I found a post on the old linux.com about using lsof to restore deleted files. http://www.linux.com/archive/articles/58142

Give it a shot and see if it can see the files from the old partition.

Link to this post 15 May 09

Thanks, I will read the link.

I solved the problem yesterday by using a really cool program called PhotoRec http://www.cgsecurity.org/wiki/PhotoRec.

It comes with another program called TestDisk which I tried first with no success.

The minute a started using Photorec, it started dumping all the recovered data into a folder I specified. The only problem is that this person had 150+ GBs worth of data and that is about the size of my entire HDD of my PC.

I told this to my friend and he will buy an extra HDD to dump all the info there.

What Im thinking is that after recovering all that info, I will try to repair the FAT32 partition as the primary partition (which can be done with TestDisk) and see what happens.

If I get lucky, all the data will become visible and readable by my friends computer.

Link to this post 17 May 09

It is good to see that you found a viable solution that works on Linux.

The biggest issue I have had with similar software in the past is that I had to search through many years worth of data, does this software have any sorting capabilities to help you recover specified data?

Link to this post 17 May 09

Unfortunately not :(, from my experience with the software, which is very limited, i can tell you that it just asks for a path where it can dump all the data in and starts copying everything it finds.

Another issue is that it doesn't recover the file names so at the end of the process you end up with a bunch of folders with 500 files each. Each file will have a crazy file name.

As soon as I get my hands on the new HDD to dump the data on, I will start working on it and will report back my experience on that regards.

Link to this post 19 May 09

The problem as I see it is that if the drive was reformatted with HFS, then the data that was there is probably lost. There is an HFS+ driver for Linux at http://www.ardistech.com/hfsplus/ but if it was formatted as suspected, then getting the original data back is more a matter of reading raw sector data off the disc, unless it was truly reformatted (all sectors rewritten), in which case you are SOL. If it wasn't reformatted (OSX can use other file systems than HFS), then the data may be recoverable. I presume the drive was in some MS format, such as FAT32 or NTFS?

Who we are ?

The Linux Foundation is a non-profit consortium dedicated to the growth of Linux.

More About the foundation...

Frequent Questions

Join / Linux Training / Board