How do I recover lost/inacessible data from my storage device?

08
2014-07
  • Questioner

    What steps can I take to try to recover lost or inaccessible data from any storage device?

    Answers:

    • Answers
  • enter image description here How do I identify the file system used on a partition?

    In case of mechanical failures.

    Pray, it well help you and calm you down. :-)

    Introduction

    If you have a mechanical failure (e.g. random crashes, just stops working one day, weird "screeching"/"beeping" type noises), EVERY time you plug it in and turn on, you could be making it much worse. If it is very important data, I would recommend taking it to a lab / professional data recovery service.

    However, if you want to do it yourself, you can summarise mechanical failure into two categories:

    Spindle/inside problems or outside/controller problems.

    First, Spindle/inside problems. This is the worst thing that can happen to a physical hard drive, If it is this, it really depends how bad. My favourite tool for this (not free) is R-Studio, it allows you to create an image from the drive and performs many passes*, then perform the recovery from the image.

    * (I have actually had drives fail a read from a sector, but just from trying over and over, it has worked - even unplugging and plugging it back in)

    Depending on how important the data is, and if you are not able to read, I would try the freezer trick. This sounds like a joke but it really is not. Put the drive in an air tight bag and stick it in the freezer for a good few hours (I usually leave it in for 6 hours or overnight), then, when you plug it in, you can get a good 15-30 minutes before it crashes again.

    If it is a controller board problem then, the only way to fix it is to reflash the drive (check manufacturers website), or most commonly, switch the controller board (Carefully) from one that is an identical model.

    For flash drives, again, if important, go to a lab. If you want to do it yourself, there isn't really a lot to say.

    Is the error with the controller or the memory?

    Typically, if it is the controller, when you plug in the drive, nothing will happen. If it is the flash memory itself, it sort of acts like a floppy/cd drive without the media in - you can see a drive letter, but just can't access it (sometimes get the insert media warning).

    If it is the memory itself, I do not know a fix.

    If however it is the controller, I have only ever had luck about 40% of the time doing it myself(and it depends on the architecture of the stick). Many of the cheaper sticks you see have two boards - one is the controller and the second (not sure the technical term), is a snap on daughter board. You can usually just unplug the memory and plug it in to another board.

    Usually the board doesn't even have to be from a similar drive, just try to get the chip provider correct (e.g. branding on one of the ICs), the most common one I see is from Winbond and they typically work with any memory chip.


    • Related Question

    linux - What is the best tool (and my chances of success) for recovering files from an Ext4 partition?
  • Fred Hamilton

    I have a 500GB drive. The first 100GB was an ext3 Ubuntu 9.04 installation, the last was formatted as a 400GB ext4 for storage. I had a lot of files on that 400GB partition - most weren't important, but there may have been some that were important and not backed up.

    This is too bad because at 2AM last night I reformatted the first 300GB of the drive by dd cloning a 300GB drive to it. So the drive became 150GB ext3 Ubuntu 8.04, 150GB xfs, and 200GB unformatted (the last half of what was my 400GB ext4). The xfs partition that was copied was empty on the original disk, but since I used dd, I think that means all the sectors were overwritten (is that correct?). In which case I would literally only have data for the last half of the 400GB volume I'm trying to recover from.

    1. What are the chances I'll be able to recover any of the files off of the ext4 drive? If it's a wild goose chase I'll stop now.
    2. If it's worth a shot, what would be the best tool to do it with?

    EDIT: The answer (placed here because it's sort of buried in the comments below) was using the PhotoRec utility from the SystemRescueCd live CD. It recovered quite a few files even though half the partition had been overwritten.


    • Related Answers
  • Axxmasterr

    chances are you will not be able to recover your data. In this situation it is likely that the previous data on the ext4 partition was overwritten. If your first partition size was originally 100GB then any subsequent imaging would need to be the same size otherwise it would cut into the 400 GBext4 partition. Any partition larger than the original 100GB will cut into the 400GB partition and result in the erasure of data. The 300 GB partition you created effectively wiped out the 400 GB partition because the two invariably must share some of the same sectors on the disk.

  • MIH1406

    extundelete: extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. http://extundelete.sourceforge.net/

  • IanN

    Im sorry but I have to disagree with axxmasterr

    You are able to recover data following a dd clone. I had a client who accidently performed a dd on x3 1 tb drives twice, (dont ask how he did this) and data recovery was 100% possible. We recovered all his files. The only issue we had was the size of the drives, being 1 terabyte called for a load of memory to run the data recovery analysis.

    Use a tool called R-Studio. It runs from windows, mac or linux. It recovers any type of file system, more or less. You will be surprised what it recovers. It performs deep analysis of drives. I have never had any issue even after multiple formats on drives or mac, linux, bsd. Yes at some point the data will be re-written completely over. But until that point, its possible to get to close 100% back.

    I dont work for r-studio to clarify.