Re: Tools to retrieve images from dead hard drive and/or deleted partitions
On Fri, 2012-12-28 at 21:35 +0900, Osamu Aoki wrote:
> Hi,
>
> On Thu, Dec 27, 2012 at 10:17:56PM +0100, berenger.morel@neutralite.org wrote:
> > Ok, first, sorry to ask two questions at a time: dead drives and
> > deleted partitions are different things, I know that.
> ...
> > (2), I've more hopes, IF the user stopped the destructive process
> > before the disk was fully erased, but I'll need the good tools.
>
> Look for Debian package testdisk
>
> http://packages.debian.org/sid/testdisk
>
> When my PC HDD became dead completely, I used this testdisk to recover
> photos on SD card in camera after erase. Of corse, any files
> overwritten by newer images were lost. But, it was a very easy job and
> I got most of the recent photos. It guides you through nicely. (I worked
> on disk image first...)
>
> After everything went fine, I tried to run unrecommended mode --- work
> directly on erased SD card. Wow, it worked for me.
>
> PhotoRec mentioned by another comes as a part of testdisk suites of
> tools.
>
> I still recommends you to make disk image first. If buying big HDD for
> disk image is not your option for some reason, you may try this
> dangerous direct recovery trick using some live CD and testdisk package.
> It is better than doing nothing...
>
> In any case, you should practive recovery on small test case first ...
If a drive really is broken, then it's an issue and a backup of the
complete drive, also of the deleted files is useful, if the drive isn't
broken, the data simply was deleted, then nothing bad could happen if
you mount the drive read only, no backup is needed. If you don't mount
the drive read only, but with write access enabled, then each access
could cause additional loss of deleted data.
I only can repeat, that the OP by all means should mount the drive read
only.
Hth,
Ralf
Reply to: