Newbie with question Topic is solved

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
KJBGBW
Posts: 6
Joined: 13 Oct 2013, 15:38

Newbie with question

#1 Post by KJBGBW »

Hey, folks-

My apologies in advance if I'm breaking any protocols here; I've tried in vain to figure out how to use testdisk to save six years of home video from a 3-TB external hard drive (WD MyBook). I let testdisk run all night and it seemed to confirm what I already suspected; my files are all safe; I just can't get to them because the drive is now RAW. I wanted to load screenshots, but in my sleep-deprived state, I somehow deleted them. (Yeah, I know... I'm not giving you much cause to want to invest any time or energy in me...)

Anyway, I've used a program called Directory Snoop to recover deleted files in the past, so instead of running the testdisk program for another eight hours, I just let Directory Snoop show the list it generated (which takes literally less than a minute). To me this confirms that my files are all there, safe and sound, but that I simply need to find a way of fixing the lone item that shows up in red (screenshot attached). Can any expert out there corroborate this? And if so, if I run testdisk again and show you all the screenshots, could I beg one of you to walk me through the steps to fix that lone problem? I would be deeply indebted to you (and I'd definitely make it worth your time. I promise!)




Thanks!

Kevin
Attachments
Directory Snoop screenshot of M Drive (10-13-2013).JPG
Directory Snoop screenshot of M Drive (10-13-2013).JPG (225.62 KiB) Viewed 6050 times

bartleby
Posts: 10
Joined: 26 Sep 2013, 01:49

Re: Newbie with question

#2 Post by bartleby »

Hi. Not everyone is familiar with "directory snoop" so perhaps it would be better to ask the question in a directory snoop forum. In directory snoop what does an item in red indicate? Just my opinion but I would let testdisk run its course and attempt to rebuild the partition table if it is possible. The wait is a small price to pay because if you have to recover a lot of data on a 3TB drive in raw mode it will take a long time.

KJBGBW
Posts: 6
Joined: 13 Oct 2013, 15:38

Re: Newbie with question

#3 Post by KJBGBW »

Thanks for the reply, Bartleby, and it's a fair point. Not sure Directory Snoop even has a forum, but my hope was that somebody here who is more familiar with reading the technical information than I am would know at a glance if recovery is likely (or even possible.) As for your question, the red letters in Directory Snoop indicate deleted items; the program allows you to just hit UNDELETE and the file is recovered. I suspect the file noted in red is corrupted rather than deleted, and that makes it trickier. Even so, as soon as I can let testdisk run all night again, I'll grab the screen shots over again and hope for the best. Another question, if I may: Where does testdisk save the logs it asks to create? Both times I've run it, I've told it to create a log but I don't know where they are. If anybody can help me and has a followup question, I'll know what to offer them. Thanks again for taking the time!

bartleby
Posts: 10
Joined: 26 Sep 2013, 01:49

Re: Newbie with question

#4 Post by bartleby »

Hi. On my system testdisk.log is created in my /home directory. You can search for it if necessary with: find / -name testdisk.log

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Newbie with question

#5 Post by cgrenier »

If you only want to undelete a file, run TestDisk, go in the Advanced menu, select the FAT or NTFS partition and choose Undelete.

KJBGBW
Posts: 6
Joined: 13 Oct 2013, 15:38

Re: Newbie with question

#6 Post by KJBGBW »

Hi again, guys, and thanks for the advice. I'd almost like to try that, cgrenier, but I don't see how it could be that simple. I know for certain that the file with the videos wasn't deleted, but I don't remember exactly what suggestions were coming up when I did the full testdisk run. I just remember that I got to a certain point and came across a screen that didn't match any of the examples I'd seen around this forum. I'm going to have to wait until I have a couple days off and I can let the thing run all night and grab the screenshots, then hope I can bother you folks again and get it figured out. Still hoping it's a minor fix that I simply don't know how to do yet. Thanks again!

KJBGBW
Posts: 6
Joined: 13 Oct 2013, 15:38

Re: Newbie with question

#7 Post by KJBGBW »

Hi again, folks-

Finally had a chance to hook the drive up and run through all the steps. This is where things end up. Could somebody tell me where I go from here, or is the drive irrecoverable? Thanks-
Kevin
Attachments
M Drive 06.JPG
M Drive 06.JPG (42.24 KiB) Viewed 5879 times
M Drive 07.JPG
M Drive 07.JPG (54.83 KiB) Viewed 5879 times
M Drive 08.JPG
M Drive 08.JPG (56.81 KiB) Viewed 5879 times

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Newbie with question

#8 Post by cgrenier »

The item listed in red is a deleted directory, so try the undelete function of TestDisk
http://www.cgsecurity.org/wiki/Undelete ... h_TestDisk

KJBGBW
Posts: 6
Joined: 13 Oct 2013, 15:38

Re: Newbie with question

#9 Post by KJBGBW »

Hi, cjrenier! Thanks so much for the quick reply! As it happens, though, the files the undelete option turns up seem to be files I deleted myself and that I don't really need back. In the original Directory Snoop listing, all the files I that I DO want back are still in black (which means they're there, but they're not accessible because the disk is RAW).

This actually happened to me once before, and I vaguely remember running CHECKDISK through Windows and the entire drive came back. I can't swear to that, though, and everything I've read here says NOT to run CHECKDISK. Is there something else I should try?

Again, thanks for helping!

Kevin
Attachments
M Drive 09.JPG
M Drive 09.JPG (107.81 KiB) Viewed 5874 times

KJBGBW
Posts: 6
Joined: 13 Oct 2013, 15:38

Re: Newbie with question

#10 Post by KJBGBW »

Hi again, cgrenier! Just letting you know that the information you shared with me was enough for me to figure out how to locate the files that I believed were NOT deleted. The COPY feature inside the advanced settings allowed me to start saving the lost videos, one at a time. It's been working for the past two hours and has recovered 166 of them (two years' worth!) with NO failed attempts. Four years' worth to go, but I have cause to believe I'll get them all, so THANK YOU! I said in an earlier post I'd make it worth your trouble, so I'll be contacting you by e-mail to do exactly that. You've made my day!

Kevin

P.S. And for the record, if anybody's wondering how I could be stupid enough to not have backups of these, I actually did. Three different drives went three different kinds of screwy over two days of power outages, and that's how I ended up in this mess. I am literally thanking God as well as the creator(s) of TestDisk for this program...
Attachments
M Drive 10.JPG
M Drive 10.JPG (80.94 KiB) Viewed 5868 times

Locked