Re: Tools to retrieve images from dead hard drive and/or deleted partitions
On 27/12/2012 22:17, berenger.morel@neutralite.org wrote:
Ok, first, sorry to ask two questions at a time: dead drives and deleted
partitions are different things, I know that.
Let me explain "my" (they are, in fact, friend's problems) two problems
(from different peoples).
===
0) the common part.
By the past, I've did some researches about forensics (just as an
amateur) and learned that you mostly work on copies of media from which
you are trying to recover data.
But the 2 HD from which I need to recover images (mostly jpeg, I guess.
The users only said that's photos, ignoring, and does not willing to
know, everything about format - but if that was not computer stuff, they
would have know what they've used... - ) are bigger than all my current
disks !
This will be a problem, as you should first image the disk(s) and work
from the images, not the physical disk. It is especially important for
the disk throwing errors, every read attempt may worsen it's condition.
Use tools like (g)ddrescue to make a copy despite read errors.
One is 500Gb, the other is 1Tb, where mine are mostly a bunch of 40/80Gb
+ 1 or 2 of 250Gb.
1)
I have a hard disk (1Tb, the bigger) which gave me many errors when I am
trying to read it. It makes it very slow to even read, but I've been
able to determine that it contains jpg images with a classic file
browser. I did not managed to copy any data on a safer place...
I am feared I will not even be able to retrieve one photo with my
conventional hardware... but maybe some of you will have an idea?
Again, try (g)ddrescue first, and when you have a good image work from
that, preserving the disk from further damages.
2)
I have an external hard disk which is readable without troubles. But
partitions were probably destroyed, AFAIK. The user knows (as usual)
nothing about what happened, so I do not even know if the partition
system have been remade, or if it is simply a problem like "format c:".
There are 2 partitions:
_ 1: the smaller, some Gb only IIRC, which was of type FAT when I looked
(or was it FAT32? Is it is very different?)
_ 2: the bigger, and not a little, from my memory, it takes at least 80%
of the whole disk, which is NTFS, I guess most data is there.
===
So, do someone have faced one of those problems, and come to a solution?
For the good disk where the partitions have been deleted, you can try to
recover partitions with "testdisk", it is quite efficient and fairly
easy to use even for someone not familiar with consoles.
To recover the images, regardless of the partitions status, try
"photorec", it does a very good job most of the time and it's interface
is self explanatory.
Of course, I've said to their owners that keeping data on only one HD is
suicidal, I've said that they can probably pay big amounts of money to
specialized establishments to have them back, and have kept their
hardware for some months (without using them), as a sanction (well, I
tried at some times to take an eye, but had other things to do).
But, now, I'm in holidays, Christmas passed, and I'm thinking that could
be an interesting gift to give back to people their photos of children
and drunken nights, and I hope someone here could help me to do that for
them :)
I've big fears that the owner of (1) will have no other choice that
asking to people with dedicated hardware, but I ask in case... for (2),
I've more hopes, IF the user stopped the destructive process before the
disk was fully erased, but I'll need the good tools.
Teach your friend(s) to backup as a Christmas gift, he'll thank you for
the rest of is life ! ;-)
Tools like sbackup, backintime, luckybackup and the such are easy to use
even for my mother (!) and efficient enough for single-computer personal
use.
Good luck.
Reply to: