How to: Recover data with testdisk!

[Higgo]

Go easy on me. This is my first how to. I have been up for 36 hours trying various methods to recover my lost data! Given that i'm not the most confident Linux user and I managed to succeed. I though it was necessary to share my experience.

I was making the transition from windows xp to Ubuntu Edgy. Somewhere along the line I hurt my NTFS data partition. I have all my music, videos, thunderbird profile, everything on this one drive! I was unable to mount it or use ntfsfix or even chkdsk from the recovery console off the windows xp install CD. I was not paying the best of attention when I broke it but I believe I accidentally installed grub to /dev/hda instead of /dev/sda! Maybe?

After trying ddrescue and failing. I came across TestDisk.
I decided to give it a go:
sudo apt-get testdisk
Don't ask me which repo it is on. It wasn't working very well. It kept exiting.

The version on the repositories is not the current version. However there was a rpm on the main website. I thought I would try alien out for the first time.

Steps:

sudo apt-get install alien

wget http://www.cgsecurity.org/testdisk-6.6-1.i386.rpm

sudo alien testdisk-6.6-1.i386.rpm

sudo dpkg -i testdisk_6.6-2_i386.deb

Ok we have TestDisk and PhotoRec installed.

Change to the folder of where you want to recover your files to.

cd /media/data/recover

sudo testdisk

The following steps may not replicate your needs. There are some examples of how to use TestDisk here

Choose create log file

Select which device to use for me it was /dev/hda

Select INTEL/PC Partition

Choose 'Analyze' then 'Proceed' then select 'Search'. TestDisk should now scan your device for partitions (If it hasn't already discovered them). This may take a little while. About 5 minutes on my 80 GB hard drive.

TestDisk should now list a series of partitions. I think it is listing past partitions on my drive. I'm not to sure. There are are a couple of NTFS and EXT partitions displayed. I'm guessing from past installations. Select your partition and choose 'List'. From here you can get a folder listing. Pressing 'C' to copy that folder and it's child objects in to your recovery folder.

Browse to your recovery folder!


Tips:

DMA enabled on your drive? Does your drive support it?

sudo hdparm -d /dev/hda

Turn it on

sudo hdparm -d1 /dev/hda

I can finally go to sleep now knowing I have my important data back. This has been a 36 hour ordeal and taught me a lot about Linux. I believe Christophe Grenie is the author of this great utility. I am in debt to him. Thank you.

I also believe this program can fix corrupt filesystems and be used to recover data from recently formatted drives. There are probably better how to's and easier way to recover your data, but this is all I know for now. Don't ask me what PhotoRec does! The project website has great documentation.

I guess I should also start backing up my data...


Higgo

[ceeg]

I am totally in debt to you for discovering TestDisk and posting this guide. I resized my windows partition without backing anything up and had thought I lost the rails application i've been developing for the last two weeks

What a scare.

[kpkeerthi]

Nice one. Thanks.

[BarNone49]

Very nice. Works perfect. I recovered entirely wiped NTFS OS partitions using this, and it worked like a charm.

[slick1a]

The above seems to be what im looking for .

my thread (to save copy and paste the same thing) http://ubuntuforums.org/showthread.p...59#post4514259

I got as far as
Code:

sudo apt-get install alien <here no probs ldconfig deferred processing now taking place


Code:

wget http://www.cgsecurity.org/testdisk-6.6-1.i386.rpm < for this :

wget http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
--17:01:39-- http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
=> `testdisk-6.6.1.i386.rpm'
Resolving wwwcgsecurity.org... failed: Name or service not known.

Code:

sudo alien testdisk-6.6-1.i386.rpm <for this :

wget http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
--17:01:39-- http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
=> `testdisk-6.6.1.i386.rpm'
Resolving wwwcgsecurity.org... failed: Name or service not known.

Code:

sudo dpkg -i testdisk_6.6-2_i386.deb <and for this :

wget http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
--17:01:39-- http://wwwcgsecurity.org/testdisk-6.6.1.i386.rpm
=> `testdisk-6.6.1.i386.rpm'
Resolving wwwcgsecurity.org... failed: Name or service not known.

By taking a quick glance @ my above thread link you will see the dilema im having.

1. what am i doing incorrectly ?

2. I have the tools i need but cannot locate them to use

3. Can anyone help ????

[DigitalRedneck]

It seems you forgot the period after the www

Also, the file is not available anymore. Only v6.9 seems to be available on the site now, and it doesn't want to convert with alien.

[aysiu]

This tutorial's a bit old. You don't need to use an .rpm to install testdisk.

There's a native (.deb) Ubuntu package for it:
http://packages.ubuntu.com/gutsy/testdisk

[slick1a]

The following is intended for research purposes only , I take no resposibility if you do not read this post in full before trying anything.

If TestDisk is not yet installed, it can be downloaded from TestDisk Download. Extract the files from the archive including the sub-directories.

One condition:

* TestDisk must be executed with "Administrator privileges."

Important points for using TestDisk:

* To navigate in TestDisk, use the Arrow and PageUp/PageDown keys.
* To proceed, confirm your choice(s) with the Enter key.
* To return to a previous display or quit TestDisk, use the q (Quit) key.
* To save modifications under TestDisk, you must confirm them with the y (Yes) and/or Enter keys, and
* To actually write partition data to the MBR, you must choose the "Write" selection and press the Enter key.

Code sudo testdisk-6.9/linux/testdisk_static

Here's how i did it;

1. opened terminal typed 'pho' and hit the autocomplete button (tab) why didnt i just think of this in the first place ?? dur !!

2. Enlarged terminal window as 'Photorec' needs 25 lines to work

3. Of options : Disk /dev/hdc - 2048 B (R0) selected Disk /dev/sdf - 320 GB / 298 GiB (R0)

4. Hit proceed - N/B of note: Some disks won't appear unless your a root user. Disk capacity must be correctly detected for a successful recovery. if a disk listed above has an incorrect size, check jumper settings, BIOS detection, and install the latest OS patches and disk drivers.

5. now select the partion table type, pushing enter when done :
[intel] Intel/PC Partition < my choice > usually the default value is the correct one as TestDisk auto-detects the partition table type
[Mac] Apple partition map
[None] non partitioned media
[Sun] Sun solaris partition
[Xbox] Xbox partition
[return] return to disk selection

6. checked file options photorec searches for, as i'm specifically searching for .jpegs

7. To recover lost files, Photorec needs to know the filesystem type were the files are stored:

[ EXT2/EXT3] EXT2/EXT3 filesystem
[ Other] FAT/NTFS/HFS+/ReiserFS/. . . < my choice

8. then i got fumbled so i looked up

9. http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

10. After following the above link , I located missing .jpegs . I recommend this tool for anyone who has accidently deleted a hard drive or has missing files which YOU KNOW are there somewhere.

[bryncoles]

hello! sorry to jump on an aging thread, but i was very impressed with this software when i first found it. it detected external drives when i plugged them in and recovered files fine. then i ran it as 'root', using the 'sudo' command. i was curious to see if it would work on the internal drives you see!

now, it wont do anything at all unless i run as root - wont recover files from digital camera's etc. this is rather perplexing! have i changed the file permissions on it or something? how can i change it again to its initial state - where it could detect and read external drives without being root?

[pac-man]

I was wondering if this application works for this:

I was using ubuntu to transfer some files from my NTFS partition to the external drive (NTFS too). suddenly the system locked up and I had to reboot the computer using the power button. WHen I was back data was lost!

Can this application recover specific folders and files or only whole partitions?