hard drive - Files recovered with full size but unusable
2014-04
About 3 weeks ago, I have accidentally used the "clean" command in diskpart in DOS.. And every thing in the hard drive was removed even the drive letters, it became unallocated space (465.8 GB).
I used a small part of that space (29.5 GB), to create a partition and install Win7 and kept the remaining part of the disk unformatted, to avoid any further precious data loss. I used "recover my files" to scan the hard drive, and fortunately it found most of my data, I also used "active file and partition recovery" which gave close results and saved the results of the scan for future use.
At the time I didn't have much space so I recovered what I can on another hard drive and kept most of the drive the same, unformatted in order to recover every thing later and kept using the (C) partition without touching the other partition which appears in "My computer" as (D) but inaccessible and unformatted (Raw).
Now I was able to clear some space, and I recovered a great deal of the data. I tried accessing the files but they didn't open. The documents appear to be corrupted, the rar files don't open so as the music mp3 files. Though there space appears accurate and even the music files show album information and stuff, they are useless..
I even rescanned the drive again using "recover my files" which gave similar good results but the files I recover are still inaccessible.. How do I get my files?? And what could have possibly happen different from my first recovery attempt??
I deleted the partition table of my HD. I wanted to format another one, but by mistake, I formatted the wrong one. Then I also created some new partition on it. Now I would like, if possible, to recover my old data. The old configuration was this:
A primary NTFS partition with Windows, and a secondary partition with four logical partitions: a swap and three XFS partitions (two for Ubuntu and OpenSuSE, and one with the home for both systems).
This is the output I get when I run gpart
in a terminal:
ubuntu@ubuntu:~$ sudo gpart /dev/sdb
Begin scan...
Possible partition(Windows NT/W2K FS), size(39997mb), offset(0mb)
Possible extended partition at offset(39997mb)
Possible partition(Linux swap), size(8189mb), offset(39997mb)
Possible partition(SGI XFS filesystem), size(40942mb), offset(48187mb)
Possible partition(SGI XFS filesystem), size(40942mb), offset(89149mb)
Possible partition(SGI XFS filesystem), size(175044mb), offset(130112mb)
End scan.Checking partitions...
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Partition(Linux swap or Solaris/x86): logical
Partition(Linux ext2 filesystem): logical
Partition(Linux ext2 filesystem): orphaned logical
Partition(Linux ext2 filesystem): orphaned logical
Ok.Guessed primary partition table:
Primary partition(1)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 39997mb #s(81915360) s(63-81915422)
chs: (0/1/1)-(1023/254/63)d (0/1/1)-(5098/254/51)rPrimary partition(2)
type: 015(0x0F)(Extended DOS, LBA)
size: 265245mb #s(543221849) s(81915435-625137283)
chs: (1023/254/63)-(1023/254/63)d (5099/0/1)-(38912/254/2)rPrimary partition(3)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)rPrimary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r
Looking the first eight lines, it seems the data are still there... but I don't know how to recover them. I have a free second HD of about 500 GB (the formatted one is 320 GB) that I can use for the recovery process.
gpart -W won't work, as it'll write out the new partition table that is being displayed after the first eight lines - which is in fact the new partition table. TestDisk is an alternative that will allow you to select the partitions that then want restoring.
FIRST, do a copy of your hard disc to your free one, I think the best option would be to do read dd man page and then copy the disc
man dd
dd if=/dev/sda of=/dev/sdb
assuming /dev/sda is the old one with data and /dev/sdb is the new empty one.
SECOND, use devices from /dev/disk/by-id/* . This way you could avoid errors.
THIRD, remove the newly created partitions, so the found ones can be rewritten to the partition table. Use parted or fdisk.
FOURTH, read ALL the gpart mnan page, specially the "-W" option
man gpart
sudo gpart -W /dev/sdb
Hope this helps. But you have a backup, don't you?