Testdisk has found the partition, but I can't see the files...

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
marcos76
Posts: 5
Joined: 01 Oct 2018, 15:32

Testdisk has found the partition, but I can't see the files...

#1 Post by marcos76 »

Hello guys!

Well, I spent the whole past week trying to recover my data after a crash caused by that infamous Wintoflash tool while I was trying to create a bootable USB. My hard drive is a Fujitsu 2.5" SATA 250 GB. I had more than 6 NTFS partitions and one EXT4 partition for Ubuntu 12.04 LTS.

After researching the problem and possible solution scenarios, I managed to recover all the partitions except the one I need the most, it is the EXT4 that has Ubuntu and my precious data for the past 8 years. Unfortunately, I do not have a backup elsewhere.

Anyways, I kept messing with the hard drive with a dozen of data recovery software packages, but to no avail. All of the EXT4 partitions found were unable to mount, corrupted fs or superblock, and all of the fsck attempts with all possible parameters failed. I almost gave up until I came across TestDisk, and I would like to admit here that I really underestimated the power of this great tool with it's companion Photorec.

After a deep search, Testdisk was able to find the EXt4 partition that had my files and I could go into it by pressing the "P" key, however, I guess I couldn't see the files into my home folder because it was an encrypted folder. I selected all the files and tried to copy them to another drive/partition, but after 8 hours or so, I had to stop it because I did not know when or if this will stop ever. The destination partition was a FAT32, I know it's not recommended, but here's what happened. Only a fraction of fraction of the files recovered - number was above 1.8 million when I stopped it - was available and the size of the folder shown was 1.8 GB only. When I rebooted my machine into Windows 7, the folder displayed the contents and it was much larger than reported in Ubuntu where I ran the TestDisk on the bad drive. Now, the funny things is, when I got back to Ubuntu, I went on to remove the recovery folder and its contents, but there was much much more files to be deleted than what is seen inside the folder.

Before I forget to mention, the first time I found the EXT4 partition and after verifying that my files are still there using the "P" key, I wrote the partition table and the partition was added and now mounts perfectly. However, it doesn't show any files inside, though it says 96% of the disk is full, but in the same time, only 11 MB of data were used. Weird enough, isn't it?

By the way, before I delete all the recovered files, I checked the size of the "home" folder when I was in Windows and it was about 1.4 GB. I'm sure it has my files in it, but don't know what to do next in order to make them appear again.

On more thing, when I analyze the partition, then I go to next step, list files says "support for this file system was not compiled" or something like that. However, after writing TestDisk's standard MBR, list files now works on the recovered partition and shows my files.

Now, before I do any further damage and lose the chance to recover my files forever, I made an image.dd file of the EXT4 partition and saved it in another HDD.

I have tons of stuff to take care now. Until I get a response from someone here, I will not touch it again!

Hope to hear from you soon!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Testdisk has found the partition, but I can't see the files...

#2 Post by cgrenier »

If you boot from this Ubuntu installation, it should unlock your files when you logged in.

marcos76
Posts: 5
Joined: 01 Oct 2018, 15:32

Re: Testdisk has found the partition, but I can't see the files...

#3 Post by marcos76 »

That's true! Now, the question is; how to boot into that partition? I wrote the partition table after the discovery of my partition, but it is still showing no files while 96% of the disk is occupied. I can't see all files when inspecting recovered folders, but when I delete them, it takes time and shows that there was a whole lot of files inside.

Any adivce?

marcos76
Posts: 5
Joined: 01 Oct 2018, 15:32

Re: Testdisk has found the partition, but I can't see the files...

#4 Post by marcos76 »

This is a screenshot of the files found when running testdisk /path-to-file/image.dd (attached)

marcos76
Posts: 5
Joined: 01 Oct 2018, 15:32

Re: Testdisk has found the partition, but I can't see the files...

#5 Post by marcos76 »

Well, I managed to recover some of my private data by running "ecryptfs-recover-private" against my home folder, which I have got after performing a copy process out of an image.dd file I have created earlier. The original size of the image file was 31 GB, which is the actual size of the lost EXT4 partition that had my Ubuntu installation. However, "copying files" has reached over 50 GB and I had to interrupt it. A lot of files and folders are still missing inside my home folder. I don't know if that had to do with the interruption of the file copy on the 50GB boundaries. But from where TestDisk is copying data past the actual size of the image, which was 31 GB?

Locked