Files restored with photorec but cryptic file names in testdisk

[bonzo]

Hi all!

First of all: thank you very, very much for your software. I was able to recover all data using “photorec”.

Background: I switched to Void Linux and copied data from MacOS to and (rather oldish) external Maxtor drive.

At that time (two years ago) I did not pay much attention to file systems etc., and I probably changed it several times.

Suddenly-the hard drive stopped working although I did not delete anything.

Although a tried and read a lot I am stuck now, and I would appreciate your help.

This is what happens (using an disk image, not the hard drive):

Excerpt while scanning for partitions

Code: Select all

 0 D HPFS - NTFS           3458978802 4364674746  905695945
  HPFS - NTFS           3458978802 4364674746  905695945
Invalid FAT boot sector
 0 D FAT16 >32M             301392291 3909042657 3607650367
  FAT16 >32M             301392291 3909042657 3607650367
check_FAT: can't read FAT boot sector
Invalid FAT boot sector
 0 D FAT16 <32M            1097101976 2177140635 1080038660
  FAT16 <32M            1097101976 2177140635 1080038660
check_FAT: can't read FAT boot sector
Invalid FAT boot sector
 0 D FAT12                 3981387081 6503999678 2522612598
  FAT12                 3981387081 6503999678 2522612598
check_FAT: can't read FAT boot sector
Invalid FAT boot sector
 0 D FAT12                 3145487147 3638387600  492900454
  FAT12                 3145487147 3638387600  492900454
Invalid FAT boot sector
 

Output after scan

Code: Select all

Disk /dev/loop0 - 320 GB / 298 GiB - 625142448 sectors

The harddisk (320 GB / 298 GiB) seems too small! (< 4071 GB / 3792 GiB)
Check the harddisk size: HD jumper settings, BIOS detection...

The following partitions can't be recovered:
     Partition               Start        End    Size in sectors
>  FAT12                   36432247 1971349534 1934917288
   FAT16 LBA               84620655  980256753  895636099
   FAT16 LBA              103988591  999624689  895636099
   FAT12                  295709647 2239028490 1943318844
   FAT16 >32M             301392291 3909042657 3607650367
   FAT32 LBA              317101789 2500868762 2183766974
   FAT16 >32M             339713785 4561223333 4221509549
   FAT12                  419761096 3956140632 3536379537
   FAT32 LBA              494339302 2953152956 2458813655
   FAT12                  555591404  740598764  185007361

Detected partitions

Code: Select all

Disk /dev/loop0 - 320 GB / 298 GiB - 625142448 sectors
     Partition               Start        End    Size in sectors
>D FAT12                        648       8583       7936 [EFI System Partition] [NO NAME]
 D Linux                       2046  625141757  625139712 [maxtor]
 D FAT16 >32M             255197423  440204783  185007361
 D FAT12                  524615715  524618594       2880 [NO NAME]
 D FAT12                  524715187  524718066       2880 [NO NAME]

Partition 1

Code: Select all

     FAT12                        648       8583       7936 [EFI System Partition] [NO NAME]
Directory /

>drwxr-xr-x     0     0         0 21-Apr-2020 08:16 EFI

Partition 2

Code: Select all

     Linux                       2046  625141757  625139712 [maxtor]

Can't open filesystem. Filesystem seems damaged.

Partition 3 (short excerpt)

Code: Select all

     FAT16 >32M             255197423  440204783  185007361
Directory /

>-rwxr-xr-x     0     0 2080578691  6-Jul-2016 17:38 M-5L.j}Hr0.`^K^R
 -rwxr-xr-x     0     0 1081959949 11-Mar-1983 23:28 ^AM-0^V~@G^P^Q^W.M-FM-<
 -r-xr-xr-x     0     0 2644399962 29-Jun-2021 12:55 M-1
 drwxr-xr-x     0     0 2454605228  3-Oct-1950 22:55 ^AM-0^_PG^P^Q^X.~V^F
 -rwxr-xr-x     0     0 3361315897  4-Oct-2003 05:29  ξM-u .
 drwxr-xr-x     0     0 3856227423 27-Feb-1954 23:55 ^AM-0(.M-Y
 -rwxr-xr-x     0     0 1177678941 11-Jun-1902 21:22 |M-6^[M-?M-Au^X.\M-9
 -r-xr-xr-x     0     0 2005303827 18-Sep-1961 20:54 &^G^Q1~Plmw.^_^E
 -r-xr-xr-x     0     0 825760359 20-Apr-1928 20:47 ^AM-09M-@G^P^Q^Z.^\@

Partition 4

Code: Select all

     FAT12                  524615715  524618594       2880 [NO NAME]
Directory /

No file found, filesystem may be damaged.

Partition 5

Code: Select all

     FAT12                  524715187  524718066       2880 [NO NAME]
Directory /

No file found, filesystem may be damaged.

When I backup all files from Partition 3 I get these files (short excerpt):

Code: Select all

-rw-r--r--   1 root root  3,8G 26. Mär 1905  ''$'\277\027''WT'$'\347\253''?'$'\220''.KY'$'\206'
drwxr-xr-x   2 root root  4,0K 25. Dez 1943  ''$'\300\334''Sy'$'\273''=z'$'\222''.'/
-rw-r--r--   1 root root  1,9G 30. Jan 2005  ''$'\301\030\263''oK'$'\364''ّ.N'$'\226\201'
-rw-r--r--   1 root root  3,0G 24. Jul 2034  ''$'\301\211''U'$'\251''i"H'$'\226''.'$'\032\360''$'
-rw-r--r--   1 root root  3,0G 28. Dez 2029  ''$'\302''D'$'\250\022\251'
drwxr-xr-x   2 root root  4,0K 19. Apr 2025  ''$'\302''d'$'\244\366\233\211''ce."E'$'\032'/
drwxr-xr-x   2 root root  4,0K  2. Feb 1936  ''$'\303\020\316'']^'$'\203\341\263''.w7'$'\201'/
-rw-r--r--   1 root root  973M 14. Jan 1988  ''$'\303\362\257''D'$'\244''w'$'\301\305''.'$'\275''$'$'\344'

Does anyone know how to recover my files with their correct names and the correct folder structure?

As mentioned above: All files are on the disk. I was able to recover them with “photorec”.

Thank you very much in advance!

[recuperation]

Hi all!

First of all: thank you very, very much for your software. I was able to recover all data using “photorec”.

Background: I switched to Void Linux and copied data from MacOS to and (rather oldish) external Maxtor drive.

At that time (two years ago) I did not pay much attention to file systems etc., and I probably changed it several times.

A file system change typically involves formating a partition. That story does not sound plausible.

Suddenly-the hard drive stopped working although I did not delete anything.

??? Should a hard drive stop working once you delete something?

Although a tried and read a lot I am stuck now, and I would appreciate your help.

This is what happens (using an disk image, not the hard drive):

Although the hard drive stopped working the disk image fell from the sky.
Did you use Testdisk? Did you use the "list files" function for each partition?
Did you run deep search?
If all that fails try out any commercial third party recovery tool.

[bonzo]

Thanks a lot for your comments.

Yes, I did a deep search. I found more partitions, but all of them with cryptic file names (see code sample above).

Reading your comments I can probably combine all my thoughts and testing to one question:

Is it possible (and how) to recover the original file names and folder hierarchy from the partitions with the cryptic file names?

Thank you.

[recuperation]

Yes, I did a deep search. I found more partitions, but all of them with cryptic file names (see code sample above).

Is it possible (and how) to recover the original file names and folder hierarchy from the partitions with the cryptic file names?

Try out any third party software.

Testdisk may show you partition look-alikes that are not a partition and therefore what is shown as file name inside does not have to be a file name at all.
Photorec is an armaggedon tool that does fingerprinting to find files and does not take into account possible remains of metadata (that is where your file names are located).

Third party software may also try to analyse remains of metadata.