cgsecurity.org

Hi,

I have a 2TB drive, formatted to ext4 which has begun to fail and taken the initial sectors of the drive with it (meaning I can't read any partition information for the first partition (ext4). I've run photoRec on it to try to recover my (cr2) raw photo files from a Canon 40D but all the files found are corrupted, while jpegs found are not.

All the files that are recovered appear to be somewhat corrupted. Corel AfterShot Pro loads them with bars on part of the each file and other software crashes on load (eg RawTherapee). All jpeg files that are recovered can be viewed without any problems and are not corrupted. I was using the 64-bit build of PhotoRec 6.13 (from Ubuntu 12.04's repositories), but have also tried the 32-bit build developer of 6.14.

I have read these two threads (1, 2), but they did not help.

I have most of the photos backed up on a separate drive (only a fraction are not backed up...) and I may be able to do comparisons between the original and recovered files if that will help.

Any help would be muchly appreciated

First : If it's only MBR recovery related, you should better use testdisk to scan and recover your partition. If your disk is in bad condition and you can't write on the first sector (or don't want), you will then be able to mount in read only using loopdevice. You'll recover your files with names and folders.

If it doesn't work, with Photorec 6.14, did you specify that it was from ext partition type ? Else you'll recover CR2 including filesystem superblocks...

Thanks very much for you reply.

I managed to recover my files using ddrecovery to take an image of the partition and then mounting that. Around 280kB of the drive was unreadable (although the partition information was still intact), which was reduced to ~80kB by repeated reads. The first part of the partition was the unreadable part and hence the drive unmountable.

When using Photorec 6.14, I specified ext2/3/4 when prompted (the default, as the partition type was detected). Unless you think I did something wrong, is there any thing I can do to try and debug this issue? I'd be happy to try making a test partition and comparing original and "recovered" files from it.