What settings to use to increase recovery success?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
amskuay
Posts: 3
Joined: 20 Jan 2015, 07:52

What settings to use to increase recovery success?

#1 Post by amskuay »

Thanks for this awesome program. I have been able to recover jpg files from an SD card which had been formatted. Thankyou for all the hard work you've put in!

Unfortunately, I had a little accident yesterday - I was trying to fix a thumbdrive with disk part and used the format recommended override function. Unfortunately, I specified the wrong volume and it targeted my 2TB secondary HDD. I realised 1% in and quickly stopped the procedure. When I then checked the secondary HDD, I saw that it was RAW. The bad news does not stop there. When tried to access the drive through Windows explorer, it said I needed to format the drive in order to access it. I thought that format doesn't really delete the data so I pressed ok to format. The process only took 2 seconds. Obviously the secondary HDD is now empty, but at least I can access it.

So I have used photorec to try and recover the data - it is all photos. But nothing has turned up. I had 181GB worth of photos there and it cannot seem to recover any of it. What settings would you recommend to increase my chance of recovery success? Thanks so much... My wife is close to kicking me out!

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: What settings to use to increase recovery success?

#2 Post by cgrenier »

Run TestDisk, Advanced, select the partition, choose Boot, RebuildBS, List, if you see your files, choose Write and confirm, Quit
Please post the testdisk.log content if it doesn't work.

amskuay
Posts: 3
Joined: 20 Jan 2015, 07:52

Re: What settings to use to increase recovery success?

#3 Post by amskuay »

Thanks for the reply. This is what I came back with:

Wed Jan 21 18:24:45 2015
Command line: TestDisk

TestDisk 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows WorkStation 6.2.9200
Compiler: GCC 4.7, Cygwin 1007.17
Compilation date: 2013-07-30T14:08:52
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdc)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=250059350016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=2000398934016
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive2)=2000398934016
filewin32_getfilesize(\\.\PhysicalDrive3) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive3) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive3
filewin32_getfilesize(\\.\PhysicalDrive4) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive4) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive4
filewin32_getfilesize(\\.\PhysicalDrive5) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive5) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive5
filewin32_getfilesize(\\.\PhysicalDrive6) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive6) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive6
filewin32_getfilesize(\\.\PhysicalDrive7) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\PhysicalDrive7) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\PhysicalDrive7
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=249690062848
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\D:)=19365888
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\E:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=2000396746752
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=0
Warning: can't get size for \\.\G:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\H:)=0
Warning: can't get size for \\.\H:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\I:)=0
Warning: can't get size for \\.\I:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\J:)=0
Warning: can't get size for \\.\J:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\K:)=0
Warning: can't get size for \\.\K:
Hard disk list
Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63, sector size=512 - Samsung SSD 840 EVO 250GB, S/N:S1DBNSCF102454N, FW:EXT0BB6Q
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1CH164, S/N:W1E7VXWV, FW:CC27
Disk /dev/sdc - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - ST2000DM001-1CH164, S/N:W1E7VTWQ, FW:CC27
Drive D: - 19 MB / 18 MiB - CHS 4 64 32, sector size=2048 - HL-DT-ST BD-RE BH16NS40, FW:1.01

Partition table type (auto): Intel
Disk /dev/sdc - 2000 GB / 1863 GiB - ST2000DM001-1CH164
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/32/33
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896
NTFS, blocksize=4096, 2000 GB / 1863 GiB

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.
rebuild_NTFS_BS
mft at 16, seq=1, main=0 res=1
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: sectors_per_cluster 8
ntfs_find_mft: mft_lcn 786432
ntfs_find_mft: mftmirr_lcn 2
ntfs_find_mft: mft_record_size 1024
ntfs_find_mft: index_block_size 4096
Extrapolated boot sector and current boot sector are identical.
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /$RECYCLE.BIN/S-1-5-21-772128391-2832168975-2335427895-1001
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 ..
40 -r--r--r-- 0 0 129 18-Jan-2015 21:45 desktop.ini
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /$RECYCLE.BIN/S-1-5-21-772128391-2832168975-2335427895-1001
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 ..
40 -r--r--r-- 0 0 129 18-Jan-2015 21:45 desktop.ini
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /$RECYCLE.BIN/S-1-5-21-772128391-2832168975-2335427895-1001
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 ..
40 -r--r--r-- 0 0 129 18-Jan-2015 21:45 desktop.ini
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /$RECYCLE.BIN/S-1-5-21-772128391-2832168975-2335427895-1001
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 ..
40 -r--r--r-- 0 0 129 18-Jan-2015 21:45 desktop.ini
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /System Volume Information
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
99 -r--r--r-- 0 0 131072 21-Jan-2015 16:14 001.dat
39 -r--r--r-- 0 0 131072 19-Jan-2015 21:23 002.dat
36 -r--r--r-- 0 0 76 18-Jan-2015 21:02 IndexerVolumeGuid
41 -r--r--r-- 0 0 20480 19-Jan-2015 21:24 tracking.log
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /$RECYCLE.BIN/S-1-5-21-772128391-2832168975-2335427895-1001
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 ..
40 -r--r--r-- 0 0 129 18-Jan-2015 21:45 desktop.ini
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /$RECYCLE.BIN/S-1-5-21-772128391-2832168975-2335427895-1001
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 ..
40 -r--r--r-- 0 0 129 18-Jan-2015 21:45 desktop.ini
Directory /$RECYCLE.BIN
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
38 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 S-1-5-21-772128391-2832168975-2335427895-1001
Directory /
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 .
5 dr-xr-xr-x 0 0 0 19-Jan-2015 22:48 ..
37 dr-xr-xr-x 0 0 0 18-Jan-2015 21:45 $RECYCLE.BIN
35 dr-xr-xr-x 0 0 0 19-Jan-2015 21:24 System Volume Information
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1

ntfs_boot_sector
1 P HPFS - NTFS 0 32 33 243201 45 44 3907024896
NTFS, blocksize=4096, 2000 GB / 1863 GiB
NTFS at 0/32/33
NTFS at 0/32/33
filesystem size 3907024896
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
Boot sector
Status: OK

Backup boot sector
Status: OK

Sectors are identical.

A valid NTFS Boot sector must be present in order to access
any data; even if the partition is not bootable.

TestDisk exited normally.

I had previously tried aggressive search also, but it was still running after 36hrs, so decided to stop.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: What settings to use to increase recovery success?

#4 Post by cgrenier »

Try PhotoRec, in Options, enable the expert mode, start a recovery, use a blocksize of 512, use the default settings otherwise. Do you recover your pictures this way ?

amskuay
Posts: 3
Joined: 20 Jan 2015, 07:52

Re: What settings to use to increase recovery success?

#5 Post by amskuay »

I've tried that too and it didn't really do much. I Don't understand where it could have all gone.

Locked