Re: Formatted Disk
Am Freitag, 16. August 2013 schrieb Ralf Mardorf:
> On Fri, 2013-08-16 at 10:30 +0200, Jochen Spieker wrote:
> > Ethan Rosenberg, PhD:
> > > I have a usb drive, with data on it, that I [stupidly!!] tried to
> > > name using fdisk. Of course, it erased the data. I have not used
> > > the drive since then. I think there is a method to "unformat" a
> > > drive. What shall I do now?
> >
> > Generally, it should be possible to access the filesystem if you restore
> > the previous partitioning scheme. I don't think putting a label on a
> > partition should have destroyed existing partitions, but anyway.
> >
> > If you cannot restore the old partition layout for some reason, you can
> > install testdisk and use the program "photorec". It can restore almost
> > anything, unless you write to the disk. Caveat: photorec will not
> > restore the directory layout. You will have one directory with
> > everything in it.
>
> Before you do anything like making a backup with dd and/or use photorec
> or any other recovery tool of that kind, mount the USB stick read only.
> Until you haven't restore your data, mount it only read and write, when
> needed.
I often used a tool called "getdataback_for_fat" , and "getdataback_for_ntfs".
There is a demo version available.
If this does not work, you can try dd the drive to a file, and then extract
your data from this file.
For this part I am using "deft-7.2", which is a forensic livesystem. Version
7.2 is the last, with "hb4most" on it, a nice GUI for the famous tools
"foremost" and/or "scalpel".
DEFT got also other tools on it. And it is linux! Debian based, as far as I
know.
It also has other tools on it. For Windows thereis DARTS2 on the CD, which is
also very mighty.
Hope this helps
Good luck!
Hans
Reply to: