cgsecurity.org

I am using os x catalina with TestDisk 7.1 and want to recover 1 folder on an external drive. I know the name, I know where it was (I know the name of the files inside this folder). Yesterday night I was working in this folder and today it is not there anymore. No idea if the fresh installed Catalina did this, but the folder was not deleted by hand.
Disk /dev/disk2 - 8001 GB / 7452 GiB (RO)
Partition Start End Size in sectors
2 P Mac HFS 76806 0 1 1953473872 0 1 1953397067 [LaCie]

I can recover the all external HD, it works (it is running right now) but it’s then looking the entire 8TG harddisk and recovering takes like 260 hours (!) It’s been running for 2 hours now and remaining time is only increasing (294 hours now)!

When I look here it seems possible to list the files to recover only this files:
https://www.howtogeek.com/700310/how-to ... -testdisk/
This exactly:
https://www.howtogeek.com/wp-content/up ... Apb90e.png

I don’t have the „List“ option like shown here under >[ Advanced ] Filesystem Utils:
https://www.howtogeek.com/wp-content/up ... v5em2R.png

What I see is this:
https://postimg.cc/tZSj43Rt

I don't have this option because the example is about Linux? I am wondering..

Is there any solution?
As I know date and names of the folder and of the files I want to recover, is there any other way to retrieve these by name or date?

morda wrote: 19 Nov 2020, 18:40 I am using os x catalina with TestDisk 7.1 and want to recover 1 folder on an external drive. I know the name, I know where it was (I know the name of the files inside this folder). Yesterday night I was working in this folder and today it is not there anymore. No idea if the fresh installed Catalina did this, but the folder was not deleted by hand.
Disk /dev/disk2 - 8001 GB / 7452 GiB (RO)
Partition Start End Size in sectors
2 P Mac HFS 76806 0 1 1953473872 0 1 1953397067 [LaCie]

If your file system is "MAC HFS" read here, what Testdisk can do for you:
https://www.cgsecurity.org/

I can recover the all external HD, it works (it is running right now) but it’s then looking the entire 8TG harddisk and recovering takes like 260 hours (!) It’s been running for 2 hours now and remaining time is only increasing (294 hours now)!

You should consider posting a testdisk log file.

When I look here it seems possible to list the files to recover only this files:
https://www.howtogeek.com/700310/how-to ... -testdisk/
This exactly:
https://www.howtogeek.com/wp-content/up ... Apb90e.png

I don't know what "This exactly:" should mean. Please let me understand! The picture shows a Linux partition.
This is different from what you posted above (MAC HFS).

Thank you very much for your help.
Please forgive me if my post was not precise enough.

I will search online to find out where the testdisk log file is saved under os x.
https://www.cgsecurity.org/wiki/Log_file

In my original post I was wondering if the option I see on the screenshot showing a Linux OS is also available on OS X with my "MAC HFS" file system. Because I didn't find it. Neither here:
https://www.cgsecurity.org/testdisk.pdf

I am missing the possibility (I don't know how to do) to target files, knowing their names and dates, the directory where the folder containing all WAV files was WITHOUT HAVING TO RECOVER ALL 8TB which would takes weeks.

Yesterday I shut the process of recovery because after 6 hours of processing:
Pass 1 - Reading sector 17366288/1953397067, 835 files found
Elapsed time 5h52m08s - Estimated time to completion 654h16m34
Knowing that is is getting through years of data and the file I'm looking for is from yesterday, it's gonna take 1000 hours (as the time increases very much) until it finished.

Then I checked the link you posted and went to this page:
https://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
To read it is possible to select the filetype to look for via PhotoRec. I selected only
[X] riff RIFF audio/video: wav, cdr, avi
as I'm looking for the WAV files I did 2 days ago.

But when I run the recovery, it also takes forever (after 2 hours the time increased up to 300 hours to wait). So I also stopped the process and I'm here now.

Okay. I searched online for "recovering deleted files using PhotoRec" as on the document about TestDisk the file system I use is not listed on page 25 and PhotoRec is recommended: https://www.cgsecurity.org/testdisk.pdf.
https://www.storagereview.com/news/how- ... h-photorec

I read:
PhotoRec can search files from
- from the whole partition (useful if the filesystem is corrupted) or
- from the unallocated space only (available for ext2/ext3/ext4, FAT12/FAT16/FAT32 and NTFS). With this option only deleted files are recovered.

I think the issue is that the entire 8TB (MAC HFS) needs to be scanned and this is taking way too long , even if only one filetype to recover is selected.


testdisk.log today:
Fri Nov 20 10:19:02 2020
Command line: TestDisk

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
OS: Darwin, kernel 19.6.0 (Darwin Kernel Version 19.6.0: Thu Oct 29 22:56:45 PDT 2020; root:xnu-6153.141.2.2~1/RELEASE_X86_64) x86_64
Compiler: GCC 4.2
ext2fs lib: none, ntfs lib: none, reiserfs lib: none, ewf lib: none, curses lib: ncurses 5.7
Hard disk list
Disk /dev/disk2 - 8001 GB / 7452 GiB - 1953506646 sectors (RO), sector size=4096
Disk /dev/rdisk2 - 8001 GB / 7452 GiB - 1953506646 sectors (RO), sector size=4096

Partition table type (auto): EFI GPT
Media is opened in read-only.

morda wrote: 20 Nov 2020, 10:21 I am missing the possibility (I don't know how to do) to target files, knowing their names and dates, the directory where the folder containing all WAV files was WITHOUT HAVING TO RECOVER ALL 8TB which would takes weeks.

Yesterday I shut the process of recovery because after 6 hours of processing:
Pass 1 - Reading sector 17366288/1953397067, 835 files found
Elapsed time 5h52m08s - Estimated time to completion 654h16m34
Knowing that is is getting through years of data and the file I'm looking for is from yesterday, it's gonna take 1000 hours (as the time increases very much) until it finished.

Then I checked the link you posted and went to this page:
https://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
To read it is possible to select the filetype to look for via PhotoRec. I selected only
[X] riff RIFF audio/video: wav, cdr, avi
as I'm looking for the WAV files I did 2 days ago.

But when I run the recovery, it also takes forever (after 2 hours the time increased up to 300 hours to wait). So I also stopped the process and I'm here now.

In your initial posting you are asking questions about Testdisk:

morda wrote: 19 Nov 2020, 18:40 am using os x catalina with TestDisk 7.1

Now it becomes obvious that you are using Photorec.

Do not use brute force mode on your hard drive.
Make sure the drive you want to extract from is not broken (SMART status).
Do not save to your device in question.

morda wrote: 19 Nov 2020, 18:40 Yesterday night I was working in this folder and today it is not there anymore.

I don't know what "working" is. Your "working" could very well mean that you wrote stuff onto the partition in question - big mistake.

morda wrote: 20 Nov 2020, 10:21 I am missing the possibility (I don't know how to do) to target files, knowing their names and dates, the directory where the folder containing all WAV files was WITHOUT HAVING TO RECOVER ALL 8TB which would takes weeks.

Your wish contracdicts the design of Photorec.
Use a commercial tool if you have that intention.

recuperation wrote: 20 Nov 2020, 12:21 In your initial posting you are asking questions about Testdisk:

morda wrote: 19 Nov 2020, 18:40 am using os x catalina with TestDisk 7.1

Now it becomes obvious that you are using Photorec.

When I asked I was using TestDisk. Than you posted your answer with a link to TestDisk page. On this page I read that TestDisk won't do what I want to do, and there's a reference to PhotoRec. So I use this morning PhotoRec. But the results are the same.

recuperation wrote: 20 Nov 2020, 12:21 Do not use brute force mode on your hard drive.
Make sure the drive you want to extract from is not broken (SMART status).
Do not save to your device in question.

All good.

recuperation wrote: 20 Nov 2020, 12:21

morda wrote: 19 Nov 2020, 18:40 Yesterday night I was working in this folder and today it is not there anymore.

I don't know what "working" is. Your "working" could very well mean that you wrote stuff onto the partition in question - big mistake.

Working means I was working like everyday since 1996 with the computer. An iMac I bought second end a few days before.
I work on audio files on the internal HD. Means I edit them and then I save them in a folder on an external HD.
The next day I want to work further on the other files which need to be edited and all disappeared. The folder was gone. All the rest is there. Only this folder I was working on aduring a few days without issue disappeared (sorry for my english I don't know another word than "work").
It's not hidden and it's not in the hidden trash folder of the ext. HD either.

But if I use a commercial tool, I see the folder after scanning the HD before recovery. Because of the current covid situation and no activity in my sector since april 2020, I don't have money to buy a license, I thought then I'd try TestDisk, incl. PhotoRec.

recuperation wrote: 20 Nov 2020, 12:21

morda wrote: 20 Nov 2020, 10:21 I am missing the possibility (I don't know how to do) to target files, knowing their names and dates, the directory where the folder containing all WAV files was WITHOUT HAVING TO RECOVER ALL 8TB which would takes weeks.

Your wish contracdicts the design of Photorec.
Use a commercial tool if you have that intention.

Ok thank you. I obviously did not understand the concept of TestDisk and PhotoRec. By error I thought they were the "motors" of commercial tools. Sorry.

All the best and thank you again.