TestDisk and PhotoRec both failing for file undeletion

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
MichelC
Posts: 2
Joined: 15 Nov 2016, 13:22

TestDisk and PhotoRec both failing for file undeletion

#1 Post by MichelC »

sSince this is my first time using this website (over the past few hours), I'll start by just saying hello.

I have two .html files used for bookmark backups from two usb sticks and they were deleted a couple of weeks ago, so I'm trying recovery using both TestDisk (TD) nor PhotoRec (PR), but neither one is working. Due to using Linux, sudo is required and then TD shows the two sticks in the "Select media" list, so one stick is 2G and usb 2.0, while the other is 4 GB usb and I'm not sure if it's 2.0 or 3.0, but TD says G3. If I select the 2GB stick and press Enter to continue, then the next page shows a list of partition types to choose from, so Intel, EFI GPT, Humax, Mac, None for non-partitioned jmedia, Sun and XBox.

I chose Intel and pressed to continue. The subsequent page provides a list of functions to choose from. Analyze is the fist, so I began with it, but it reports one or more errors.
Disk /dev/sdb - 2008 MB / 1915 MiB - CHS 1020 62 62
Current partition structure:
Partition Start End Size in sectors

check_FAT: Unusual number of reserved sectors 7680 (FAT), should be 1.
Warning: number of heads/cylinder mismatches 16 (FAT) != 62 (HD)
Warning: number of sectors per track mismatches 32 (FAT) != 62 (HD)
1 * FAT16 LBA 2 6 5 1020 16 48 3913856

Warning: Bad starting sector (CHS and LBA don't match)

*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
>[Quick Search] [ Backup ]
Try to locate partition
That screen unfortunately doesn't provide a way to return to the selection list for partition type, for I want to try with None, but pressing Q, repeatedly, finally permitted to just get out of TD. I just selected the 2 GB stick and the None option for partition type. This reports the following output from the Analyze function.
Disk /dev/sdb - 2008 MB / 1915 MiB - CHS 1020 62 62
Current partition structure:
Partition Start End Size in sectors

P Unknown 0 0 1 1020 16 48 3921920

>[Quick Search]
Try to locate partition
A Search option is provided, so I ran this and this found the correct partition type of FAT32. I then had the program continue and eventually was permitted to indicate where the file to be undeleted is located. I then selected the file, which is shown in red, and used the 'c' option to have TD work on only this file. TD then showed my Linux /home directly and said to indicate which one to saved the apparently recovered file. I chose my Documents subfolder and had TD try to save to this. Then I used a file manager to check that folder and it's totally empty. That's also true when trying the ls and "ls -a" commands using a terminal window.

So, I went back to the file selection screen to try the recovery operation one more time, finding the list of files were now headed, saying, with the following message:
Copy done! 1 ok, 0 failed
Why am I not seeing the file where I told TD to save the copy to? :?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: TestDisk and PhotoRec both failing for file undeletion

#2 Post by cgrenier »

If you have copied "\directory\file.doc" to E:\destination", check the directory "E:\destination\directory"

MichelC
Posts: 2
Joined: 15 Nov 2016, 13:22

Re: TestDisk and PhotoRec both failing for file undeletion

#3 Post by MichelC »

I copied the file from the 3 GB stick with the source directory path being, KINGSTON/Backups/, and had it copied to my installed Korora 24 Linux system, to my /home/Documents folder, which has absolutely nothing in it, including when checking it using the "ls" and "ls -a" commands in a MATE desktop terminal.

Could TestDisk have placed the copy of the file to or in a different location than the one I indicated to use?

Answer is yes. I just used Caja file manager to check all other folders under my /home directory and see that there's a new folder that neither I nor Linux created. It's named BACKUPS and doesn't show up as one of my /home subfolders in the Places pane located on the left side of Caja's interface. Looking in the large panel making up the rest of Caja shows the new subfolder though. Checking it, it does have the bookmarks.html file I used TestDisk to copy.

It's odd, for TestDisk had permitted me to choose my Documents folder, so /home/michel/Documents; but, instead of using it, it's /home/michel/BACKUPS that was created and used for the file copy, and this is without informing the user.

:?

Locked