Restore files from windows XP partition deleted from Ubuntu

[Margaret Dumont]

I believe what happened is that the file I wanted to erase was already selected so I just had to press DEL, but I failed to realize that for some reason the work folder was also selected out of my sight.

It's possible that a confirmation window popped-up but I only realized what happened afterwards because it took an instant too long (at least a bit more than I expected) to erase such a small file.

I was running the default main user of Ubuntu that requires you to perform sudo when executing sensitive commands.

Yes, it was wonderful. Actually, it's been a "great" week altogether... Now I expect seven years of good luck to compensate.

[Margaret Dumont]

Ok. So I tried to make the Windows partition as read only to prevent anything to mess up with the drive by

sudo mount -o remount,ro /media/xp

but it said that remounting is not supported so I just did

sudo umount /dev/sda1
sudo mount /dev/sda1 /media/xp -o ro

which worked well.

Now a friend of mine has lent me an external hard drive so I can make a copy of the partition, but dd has many options (clone, image and backup) and I'm not sure if all of them will copy the whole structure of the partition (in particular the "empty" regions where my files might be). Do you have any advice on which is the way to go for me?

Thank you!

[dragonfly41]

You can also use clonezilla to take a copy of your entire disc drive.

http://ubuntuforums.org/showthread.php?t=1736591

There is a copy of clonezilla on Parted Magic .. or burn your own CD.

Might be safer burning this Parted Magic rescue disc on another working PC to avoid any overwriting of deleted files in your drive you are trying to recover.

http://partedmagic.com/doku.php?id=downloads

[mdurham]

you don't need any options with dd, you would do:

(assuming that the windows partition is on sda1)
sudo dd if=/dev/sda1 of=/media/BACKUP_DRIVE/WindowsBackup.dd

"if" is input file
"of" is output file
look in /media for the backup drive name

WARNING: be careful, dd will not protect you from silly mistakes, it will do exactly what you tell it without question.
Obviously, also make sure there is enough room on the backup drive.
Good luck.

[mdurham]

fdrake wrote: "reality is your pure immagination".
That's assuming that your imagination is pure, it might not be.

[Margaret Dumont]

Thank you.

I created an image of the partition with dd and it's 30 GB, which is perfect cause that was the size of the partition.

Since my files didn't seem to be between Testdisk's recovered files I tried with Photorec. The first had "only" found about 2200 files and the last has found about 5000. And to me it seems that at least some of the files I erased have been found (it's hard to know at first sight if it's all of them), which makes me feel somewhat relieved.

The big problem now is to sort out the meaningful files from all the trash since the names have nothing to do with the originals and there's no such thing as a directory structure and everything is mixed up in a single folder. Besides, they haven't kept the original creating date either.

Luckily, Photorec has an option to look only in the free space of the partition and, since I didn't have much, I "only" have to deal with 2 GB of recovered files.

Although right now it seems a nightmare (or maybe impossible to really succeed) to find among the 5000 files and properly name each one of the different 20 versions of a same article, to name an example, so I don't feel right now like I've truly recovered the files yet.

Does anybody have any experience with a program that does something in between Testdisk and Photorec?

[Margaret Dumont]

Now that I've looked through the recovered files in more detail it seems to me like Photorec only found certain kinds of file types. I couldn't find any *.bib or *.opj, which were among the deleted files.

Doing a search within the recovered files:

/media/External_Hard_Disk/Recovery$ find . -name *.bib

yielded no results at all.

I'm afraid that, unless I find a program able to bring back any kind of file, many of my files will remain lost beyond recovery.

[dragonfly41]

Although Photorec does recover files you've found that it is difficult to identify the files you want from hundreds of randomly named files. the file directory is lost.

I have reported in a number of posts here that I have had good results using recovermyfiles from http://www.recovermyfiles.com. the file names are preserved .. usually .. and you can select the files to be recovered .. and extensions such as *.bib or *.opj .. by ticking each folder. Photorec does not provide this flexibiiity.

However ..

• this program only runs on windows .. probably on another working PC
• you need to physically and carefully remove your damaged drive (unless it is an external drive) to place it in a USB container to be analysed by recovermyfiles and this may have the risk of you physically damaging connectors etc. or not using anti-static precautions .. a job best done by an experienced person

[Correction] I see that you now have an external clone of your disk so this step can be eliminated.
Just plug your external drive into another windows environment where you can experiment with recovermyfiles].

• it is not free .. although you can use it first in trial mode to see if you can recover files

There are other (free) forensic data recovery tools you can try such as foremost and scalpel.


[ADDED RESEARCH]

*.bib seems to be associated with Papyrus database file

http://dotwhat.net/bib/1239/

bibliographies?

The .BIB file extension is an ASCII formatted list of references.


*.opj seems to be associated with rCAD PCB Designer

http://dotwhat.net/opj/4113/

Cadence pcb design?



I suggested use of TEXTstat in this thread ..

http://ubuntuforums.org/showthread.php?t=1739701

to analyse the corpus of hundreds of files with random names.

After installing TEXTstat (see instructions in thread) create a corpus of your 30 GB of files recovered from Photorec.

Then apply word frequency list from corpus.

Then search for key words in word frequency list to narrow down your search.

You can inspect the concordance of files.

...

Another approach you might try is to write a bash script to scan through your recovered files and inspect metafiles.

[Margaret Dumont]

Thanks, dragonfly.

The *.bib files are BibTeX bibliography databases in text format, and *.opj are Origin Projects. But they were just two examples. There were many other file types among the files I'd like to recover that Photorec doesn't recognise.

For instance, results of data analysis (*.dat), which are basically two columns of numbers. The problem is that, let alone the fact that I would have to examine every single *.txt file to find the meaningful candidates, without the folder structure where the material was specified, and the name of the file that included the magnitude and temperature, all this numbers are completely useless.

I'm downloading now Hiren's Boot CD which has several file recovery utilities. I'll let you know if I make any progress with that.

[dragonfly41]

Here is the ubuntu link on data recovery ..

https://help.ubuntu.com/community/DataRecovery

I really would try recovermyfiles in evaluation mode.

[EDIT]

Also re: Photorec .. read these ..

Read these ..

http://www.cgsecurity.org/wiki/File_...ed_By_PhotoRec

http://www.cgsecurity.org/wiki/After_Using_PhotoRec