so basically i were going to re-install one of my office computer and i accidentally pick a wrong hard disk that supposed to store some important office data
i just realize it after installed the OS, split the hard drive into two partition (it used to be just one partition) and install a few software within it.
it took all days for me to read the instruction about photorec and gratefully i could recovered 95% of JPEG and docx file with just a few error.
and thanks to this incident, i became kinda interesting about digital forensic and data recovery. and i got some question after i've done my recovering
1. is that possible to make an image.dd from accidentally deleted partition?
2. what is the difference between Extended NTFS and primary NTFS?
3. and this is the most thing i confused at, i'am pretty sure the hard disk drive before formated is NTFS file system, but when i recovering the hard disk with NTFS system file it not recovering any files from previous hard disk i have formated, instead it only recovering files from deleted %temp installation folder
but if i recovering it with the ext/ext2/ext3 status, it could recovering the data from the previous hard disk i've formated
could anyone give explanation about this? i am pretty sure it was NTFS file system when they stored the file in the hard disk
P.S : i am a windows user, not really familiar with linux bash command or C++, but i willing to learn if you give me some explanation
and pardon me for my bad english/grammar
a few question after successfully recovered my JPG
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
-
cgrenier
- Site Admin
- Posts: 5432
- Joined: 18 Feb 2012, 15:08
- Location: Le Perreux Sur Marne, France
- Contact:
Re: a few question after successfully recovered my JPG
1. You can use TestDisk to create an image of a single partition or of the whole disk. In the Advanced of TestDisk, you can use 'a' to manually add a "partition" corresponding to the free space where your partition was and use Image Creation on it. But remember it's an exact image, so everything you recover from it would have been possible from the disk itself (excepted disk with bad sectors)
2. I don't remember using Extended NTFS or primary NTFS expression. But an extended partition can hold several logical partitions. With a PC/Intel partititon table, there can be only 4 primary partitions or 3 primary partition with one or several logical partitions.
3. PhotoRec find the blocksize from the first 10 file it found, PhotoRec may be confused if you are recovering from a partition that wasn't at the exact same location than the partition that was holding your files. BTW the Expert mode is done to deal with such situations.
2. I don't remember using Extended NTFS or primary NTFS expression. But an extended partition can hold several logical partitions. With a PC/Intel partititon table, there can be only 4 primary partitions or 3 primary partition with one or several logical partitions.
3. PhotoRec find the blocksize from the first 10 file it found, PhotoRec may be confused if you are recovering from a partition that wasn't at the exact same location than the partition that was holding your files. BTW the Expert mode is done to deal with such situations.