linux - How to recover data from a formatted hard drive?

03
2014-01
  • arjuncc

    This question already has an answer here:

    • Answers
  • Stigster

    First of all, stop using the drive and power off the computer with the drive in question. Continued use can make it harder (impossible) to recover anything that might be there.

    Second, consider using a professional service. I'm not promoting anyone or anything here, I'm just saying that recovery can be a tricky business, and if done wrong it can (again) destroy any recoverable data.

    If you want to try carving out the files yourself, connect it to a different machine or boot using a CD, USB or a different HD and run a file recovery or file carver against the drive. Scalpel is one software option. I have another softwarename written down in the office... Will update.

    UPDATE: The name of that other software is Adroit Photo Forensics.


    • Related Question

    linux - How to recover deleted files?
  • vijay.shad

    My laptop has two os. one is windows vista. and other is Ubuntu. I am currently on ubuntu system, this is my primary OS.

    There are 4 partitions of my hard disk

    1. Windows OS
    2. Linux(Ubuntu OS)
    3. Data

    Now the problem part. The data partition is NTFS. I have mounted this partition on the location /media/windrive-a under ubuntu OS.

    A little while back i decided to delete the mounting of the data partition and i fired command rm -r /media/windrive-a/. To give me a shock; all my data on data drive is gone.

    Now, I know this is not the command to remove mounted partition. But I have committed the wrong. Is there any way i can get my data back. These are very important data for me.

    Please suggest.


    • Related Answers
  • geek

    Your best bet would be to "freeze" the data filesystem and don't alter it. For recovery attempts, make a partition image with dd and try to recover files from there.

    WARNING: dd is a dangerous command if you misuse it by mistake, so make sure you understand what it does, how it does it and double check the command line before hitting Enter.

    You might want to try TestDisk, it claims to be able to recover stuff from NTFS. Can't vouch for it, because I've never had to deal with such situations (yau, I've never experienced loss of personal data, see below why).

    Also, since you said that the data is very important to you, there's something else you must consider. If you would have a backup, that would save you. It seems you don't have one yet, so after dealing with data loss, it'll be a good idea to think about a backup strategy for really important data.

  • Dennis Williamson

    In the old times I used to use undelete, a DOS command that usually required remembering the first letter of the archive list it showed you (?y_file.doc ) and required no alteration, no save or touch the disk (btw, an overwrite with the same name of the file will kill any possibility of recovering it, as far as I know). As all what can save you is a temporary memory, would be overwritten with new activity.

    For NTFS, I have not needed to try, (I am on the same page as Geek, I'm paranoid with backups, so rarely lose something), but from time to time I end up at below site, I am curious if it really is useful. Probably it is, quite, and it is open source :

    http://ntfsundelete.com