Restore data on unallocated space
2014-04
I'm trying to recover a deleted partition. The partition can't be restored from the partition table.
I've tried EaseUS Data Recovery, which finds files but crashes halfway through. I've also tried Find and Mount which doesn't seem to find anything, not even valid partitions on the drive.
My questions:
- What tool would you recommend for recovering data in unallocated space?
- Would it be harmful to write a new empty partition over where the data used to be to try another recovery tool?
Never write anything to a disk you are trying to recover data from
Also, if possible, make an image of the disk with dd
, ddrescue
or whatever suits you.
Download a linux live cd (I strongly recommend System Rescue CD)
Use testdisk to recover the old partition table. This would be the basic steps:
- Run
fdisk -l
to find out your disk device node - Run
testdisk </dev/sdX>
replacing accordingly - Selectthe partition table type (usually
Intel
) - Select the
Analyze
command
From here on, it depends on whether it found your lost partition and it's recoverable. Follow the step by step guide for more detailed steps.
If testdisk
didn't manage to find your lost partition, chances are part of the information got overwritten. A good choice now would be to use photorec to try to recover as much files from it as you possibly can.
photorec
will read the disk bulk and use heuristics to recover as much files as it can from the raw data. It will be up to you then to browse through the recovered files and find what's useful and what's not.
Both testdisk
and photorec
are included in System Rescue CD.
EDIT:
You could also try to make an image of the unallocated space only, and run photorec on that image. It should be faster. I assume you already have an image of the disk at image-file
:
bash # sfdisk -l -uS image-file
Disk image-file: 0 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0
Device Boot Start End #sectors Id System
image-file1 * 2048 206847 204800 83 Linux
image-file2 206848 4401151 4194304 82 Linux swap / Solaris
image-file3 4401152 312581807 308180656 83 Linux
image-file4 0 - 0 0 Empty
So from this info we know the block size is 512 and the last partition ends at 312581807. We need to extract from there on:
dd if=image-file of=unallocated-space bs=512 skip=312581807
Writing data to the disk, especially in the area where the lost partition is supposed to be, is obviously harmful.
The disk is a big sequence of sectors, normally 512 bytes each. The partition begins on one of these sectors. The contents of the partition is a filesystem. The first sector of a filesystem can normally be recognized as such because of its structure; for instance, on FAT filesystems, the first sector is called the boot sector and contains some fields which identify, in particular, the filesystem length.
The recovery strategy would look like this:
Boot up the machine with a Linux live CD. Don't write anything to the hard disk.
Run some script or program which repeatedly reads sectors from the raw device (normally called
/dev/sda
or/dev/hda
, or something similar, depending on the type of disk and the machine hardware configuration). For each sector, try to see if it could be a boot sector for a FAT filesystem, and, if yes, extract its length.If you find your filesystem that way, copy it onto a new disk as a file (this is easily done with the
dd
command-line tool), then try to mount it as "loopback".
All of this is relatively easy a developer with some Linux skills. This document may help you, and point to some useful tools for that.
I accidentally deleted a partition which mainly served as space I put my data, labeled D: drive. The partition wasn't subsequently formatted though, following the delete incident.
Obviously the D: drive doesn't show up as it usually does when I run Windows 7. In the "Computer Management", on clicking the Disk Management I clearly see the space is now labled as unallocated.
question: How do I go about recovering my data. Perhaps what the effective data recovery software I can use to resolve this issue.
Thanks
Here is a link at lifehacker for top 5 data recovery tools
I just recently used testdisk for the first time (on ubuntu) and it worked well at finding info about my drive.
So long as the deleted partition wasn't "extended FS" or whether that new one for Win 7 is, I have never found anything better than http://www.pcinspector.de/default.htm?language=1
And it's free
I'm not completely sure this will work with the partition deleted, but Glary Undelete has worked wonders for me in the past, and it's free.
TestDisk? http://www.cgsecurity.org/wiki/TestDisk. It's helped me when I aborted a resize operation on an NTFS drive (really bad idea).