[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Help with TestDisk





On 4/28/2015 8:03 PM, German wrote:
On Tue, 28 Apr 2015 19:06:29 -0700
Seeker <seeker5528@comcast.net> wrote:


On 4/28/2015 6:09 PM, German wrote:
My USB drive won't mount. I tried TestDisk, but I am not sure what to do and how to procede. Are there any experts out there with TestDisk knowledge? Also, if there are, could anyone tell me what is good site to attach screenshots? Thanks

The testdisk web site has a pretty good sample session so you can see 
what it should look like.

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Later, Seeker

It is still confusing. Here where I got stucked. Maybe someone can chime in. Thanks.

http://forum.cgsecurity.org/phpBB3/help-with-restoring-usb-drive-t4953.html

Right from the beginning this sounds bad....

Input/output error
Failed to read of MFT, mft=17625 count=1 br=-1: Input/output error
Inode is corrupt (5): Input/output error
Index root attribute missing in directory inode 5: Input/output error
Failed to mount '/dev/sdc1': Input/output error

MFT tables are low level indexes in the NTFS file system, if they can't be read
that's a big issue.

The screenshot here

http://forum.cgsecurity.org/phpBB3/help-with-restoring-usb-drive-t4953.html#p15748

looks like you already got the partition list and hit 'P' to see a list of files.
You should be seeing a list of files and directories at that point, none are visible
in the screenshot, another bad sign.

Was this after a deep scan?

Was the partition listed more than once, and if so did you try to view the files in all
listings for the partition?

If the cradle for the goflex has SATA connectors that plug into the HDD like the one
shown here...

http://www.amazon.com/Seagate-GoFlex-Desktop-Adapter-PCI-Express/dp/B00HWZ6OYC

My next step, would be to plug the goflex in to the SATA power and data cable in a
desktop system. When plugged in on USB more is done in software, the SATA controller
on the motherboard is better able to recover from errors if there is more going on than
 just filesystem corruption.

I've dealt with a few of the goflex drives and had to shave the plastic on the SATA power
and data cable with a razor blade to get them to fit into the connectors on the drive without
 taking the enclosure apart.

Typically at this point I would run the Gnome disk utility, and do a full smart test on the
hard drive. If the drive already has errors recorded that the disk utility doesn't like it may
 give you an indication of this when you run it. You can also view a list of Smart data in the
disk utility. Pending remaps and uncorrectable errors are a couple of the more significant
things to look at.

Sector remaps only happen on a write, so a handful of pending I would not consider an
automatic failure, if you are getting into the neighborhood of ten or more I would question
the reliability of the drive.

This could be done from the command line with smartmon tools, but I'm not familiar with
it's usage.

If the disk physically looks good, then I would try testdisk again.

If you can get access to the files, you want to have another drive ready to copy the files
to or enough free space on the drive you are running from to hold the files.

If you get an indication that the disk is failing, then the question of how important the data
is to you comes into play, poking at a disk that is physically failing could reduce the chance
of a professional data recovery service being able to recover the files.

If testdisk still doesn't show you and files and directories, then I would try photorec.

Photorec doesn't do well with files that are fragmented, and if it can recognize files may give
you numbers for names, instead of the actual file names, it does have a brute force option
that will try to piece the file chains together and match the files to names. The brute force
option has to be enabled before doing the scan.

http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

If you use the brute force option be prepared for it to take days to analyze the partition.

Later, Seeker





Reply to: