Sunday, August 2, 2015

TestDisk, The best data recovery tool I have ever used

One of my friends had a problem with his portable hard disk (WD10TMVW)  which appeared to be an issue with a corrupted partition table. It was not detected by Windows. Fortunately it was detected by Fedora, but it was not auto mounted. It was appeared only in /dev directory.

I tried many data recovery tools to retrieve the data, but all the tools failed, many of them even failed to recognize the disk. However "TestDisk", in fact photo_rec was able to detect the disk and recover few files. after recovering few files, it went to an endless loop. I believe this  was happened due to some bad sectors.

So I went though their forum and found out that editing a status file (i.e. photorec.ses ) you can start recovery from a given sector. this status file is used by the tool to resume previously stopped recovery session.

The second line of this file keeps the last processed sector.
If you encounter the endless loop, you can change the highlighted value and restart the recovery. You must choose Y when the tool asks to continue previous session.

2nd line of photorec.ses generated by photo_rec:
/dev/sdc partition_none,255,blocksize,512,fileopt,fat,disable,ext,disable,options,paranoid,keep_corrupted_file_no,wholespace,search,status=ext2_off,185497,inter

Whenever you encounter the endless loop, you have to do this modification and restart the recovery.
So, eventually I was able to recover most of the data from the disk, thank to this great tool.

Home page of TestDisk: http://www.cgsecurity.org/wiki/TestDisk

2 comments:

  1. Ty so much! worked!!! yes i could find this info in the formus but google brought me here faster

    ReplyDelete
  2. A couple of serious suggestions: use ddrescue to read the disk and make an image of it. Then use testdisk to try to fix the filesystem in the image. loopback mount the image to copy files or photo_rec to recover either all files or erased files.
    https://en.wikipedia.org/wiki/Ddrescue
    https://superuser.com/questions/501346/read-repair-data-from-broken-floppy-disc-on-a-linux-system
    You may want to take a look at the predecessor to GNU's ddrescue for your sys-admin toolbox:
    https://web.archive.org/web/20160425090831/http://www.garloff.de:80/kurt/linux/ddrescue/
    https://askubuntu.com/questions/211578/whats-the-difference-between-ddrescue-gddrescue-and-dd-rescue
    I have no experience with this but to repair the disk, take a look at:
    https://en.wikipedia.org/wiki/SpinRite

    rgds

    P.S. please take a look at hCaptcha vs. reCAPTCHA

    ReplyDelete