File undelete all files only recovers a few files

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
irregular
Posts: 2
Joined: 01 Jul 2018, 01:14

File undelete all files only recovers a few files

#1 Post by irregular »

Hello everybody,
TestDisk is awesome, my sisters hard drive failed and I've been trying to recover her user folder. I've read a few guides about this, I've also managed to recover most files without filenames using photorec but I want to see if I can extract filename information.

So I made a partition image and when I list files I see there are none. When I go to Undelete I see probably all the files with folder info and here I press a to select all files and set a destination folder.
The result is that around 4905 files from 290 000 files are recovered and the rest are discarded. TestDisk acts as if the task was completed. It doesn't mention why it skipped the rest of the files and no errors reported. Is this normal?

I tried using the old hard drive but bad sectors make it very slow to recover anything.
Thank you for the software and for your help. :D
Attachments
Untitled-1.png
Untitled-1.png (22.78 KiB) Viewed 3327 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: File undelete all files only recovers a few files

#2 Post by cgrenier »

Unless your sister deleted her files, you should run TestDisk, Advanced, List and Copy them.

irregular
Posts: 2
Joined: 01 Jul 2018, 01:14

Re: File undelete all files only recovers a few files

#3 Post by irregular »

Hey! Thank you for the software!

I just tried out what you mentioned but I get no files like in this screenshot. I'm reading your pdf manual but ddrescue gets to 31% and then gets stuck.
I'll just keep trying other methods.

Thank you for your time.
Attachments
Untitled-1.png
Untitled-1.png (10.17 KiB) Viewed 3316 times

left1000
Posts: 3
Joined: 30 Sep 2018, 21:21

Re: File undelete all files only recovers a few files

#4 Post by left1000 »

ddrescue doesn't get "stuck"
ddrescue has options for bypassing damaged sectors.

Here's one example.
http://www.forensicswiki.org/wiki/Ddres ... cue_1.4.2B

Now, this is a bit of a nitpick but when you said "but ddrescue gets to 31% and then gets stuck." If you really mean "gets"... that means you've tried it multiple times? Which means it's not resuming from where it left off, which is what it's supposed to do if you're using the same log file both times.

I'd also like to mention of course in order to use ddrescue to create an image, the drive you're saving the image too needs more free space than the total size of the original hdd.
If ddrescue really has errors at 31% that could either be really bad, or not that bad. One or two bad sectors would just mean 31% was damaged, but 0-30% and 32-100% might be fine. That's basically the entire point of using ddrescue, it can cope with errors and get past them and give you a result other than "getting stuck".

Just wildly guessing, it's possible that you created an image of the first 31% of a harddrive, than opened that image in testdisk. testdisk looked at the partition and saw what might've been 100% of the files, but since 69% of the harddrive the image was describing didn't exist, it couldn't continue. Your testdisk log file would explain that though.

Locked