Data recovery Help!

martinianom

A friend of mine has a "MyBook" portable HDD full of valuable photos, and other stuff.

He lent it to a friend of his and when he got it back he was not able to open it on his windows PC so he asked me for help.

When I got my hands the HDD, the first thing I did was to connect it to my Ubuntu machine.

To my surprise the HDD was readable. The thing is that the disk had 133MB worth of Time machine configuration files for a MacBook pro.

So, i'm thinking that this friend formatted the drive accidentally to HFS.

Is there any chance of recovering the info? Any idea on what program I should Use?

mfillpot

I found a post on the old linux.com about using lsof to restore deleted files. http://www.linux.com/archive/articles/58142

Give it a shot and see if it can see the files from the old partition.

martinianom

Thanks, I will read the link.

I solved the problem yesterday by using a really cool program called PhotoRec http://www.cgsecurity.org/wiki/PhotoRec.

It comes with another program called TestDisk which I tried first with no success.

The minute a started using Photorec, it started dumping all the recovered data into a folder I specified. The only problem is that this person had 150+ GBs worth of data and that is about the size of my entire HDD of my PC.

I told this to my friend and he will buy an extra HDD to dump all the info there.

What Im thinking is that after recovering all that info, I will try to repair the FAT32 partition as the primary partition (which can be done with TestDisk) and see what happens.

If I get lucky, all the data will become visible and readable by my friends computer.

mfillpot

It is good to see that you found a viable solution that works on Linux.

The biggest issue I have had with similar software in the past is that I had to search through many years worth of data, does this software have any sorting capabilities to help you recover specified data?

martinianom

Unfortunately not , from my experience with the software, which is very limited, i can tell you that it just asks for a path where it can dump all the data in and starts copying everything it finds.

Another issue is that it doesn't recover the file names so at the end of the process you end up with a bunch of folders with 500 files each. Each file will have a crazy file name.

As soon as I get my hands on the new HDD to dump the data on, I will start working on it and will report back my experience on that regards.

woboyle

The problem as I see it is that if the drive was reformatted with HFS, then the data that was there is probably lost. There is an HFS+ driver for Linux at http://www.ardistech.com/hfsplus/ but if it was formatted as suspected, then getting the original data back is more a matter of reading raw sector data off the disc, unless it was truly reformatted (all sectors rewritten), in which case you are SOL. If it wasn't reformatted (OSX can use other file systems than HFS), then the data may be recoverable. I presume the drive was in some MS format, such as FAT32 or NTFS?

abrenar

this is a great tool, i will try it at home, i will gonna corrupt my brothers windows xp with lots of games hehehehe.
then try to recover all files that erased on that hdd, and after i will reformat to ubuntu so my brother will force to obey his great Older brother that loves ubuntu Linux.

:P :P :P

CCC

If the original drive was formatted FAT or FAT32, then the file names are all kept in the file allocation table at the start of the disk... and if this probable reformat has wiped the file allocation table, then the filenames, the directory structure, all that stuff is gone.

If that is what happened, I don't see any way to get anything better than all the files with random filenames.