cgsecurity.org

First, let me say I discovered TestDisk/PhotoRec many years ago and used them at the time to recover files from a small-ish hard drive. Because it was so long ago, I don't remember whether I used TestDisk or PhotoRec.

I'm now faced with the daunting task of recovering a lifetime of memories from a 1TB drive that a friend asked me to look at. Before using your utility, if I simply plugged the drive into the USB port of my Windows 10 computer, it was hit or miss whether the drive would even be recognized. And when it was recognized, there would soon be a popup (something about the drive not being valid - sorry, this was days ago, and I didn't have the presence of mind to grab a screen shot).

Next, I downloaded and installed a utility from Western Digital which did a better job recognizing the WD drive, reporting it as being the correct model and capacity, but saying it had 0 bytes of data.

I was under the impression that the TestDisk utility would look at the drive and attempt to FIX any missing partitions, boot sectors, etc. and I was scared that any writing done to the drive could complicate the file recovery process, so I elected instead to process the drive with the PhotoRec program and copy recovered files to a different drive. I installed the Linux version of the utility on my Ubuntu machine so as not to tie up my primary Windows computer. This process is working, although I have been given as estimate of 3 years to complete the recovery. I have been able to verify (because I'm running your utility on a Linux system) that the destination drive does correctly contain usable recovered files.

Here's my dilemma and the reason for this question... because the drive isn't mine, I (nor my friend) has any idea how much actual data there is on that drive, and I'm not going to tie up my computer for days (let alone years) to see where this goes. If I interrupt the PhotoRec process and switch to TestDisk, my understanding is that TestDisk *WILL* alter the contents of the source disk to attempt to recover the partitions/file system. If I do this, there is a possibility that the drive will be magically "fixed" with all files becoming accessible with their correct names; but there is also the possibility that even after fixing the partition, all those files might have been deleted. In this case, will my actions with TestDisk make the probability of file recovery lower; or will I still be able to recover the files? And if TestDisk does "work", will that make the recovery process more efficient (I think that answer to that is YES). So my real concern is whether running TestDisk will potentially make recovery LESS LIKELY.

Thank you for your response.

Every write operation bears the risk of destruction of data.
The use of a possibly dammaged drive will most likely increase the dammage.
You did not check the drive for dammage.

Duplicating a drive as described in the manual protects you against the adverse outcome of repair efforts.

Writing a MBR partition structure for instance may require writing a series of sectors in case of having a couple of partitions. Selecting the wrong partitions after analysis or deep search could lead to Testdisk writing into the correct partitions instead of writing in between.

The consequences might vary depending on what was overwritten.

JEfromCanada wrote: 30 Dec 2021, 22:26 Next, I downloaded and installed a utility from Western Digital which did a better job recognizing the WD drive, reporting it as being the correct model and capacity, but saying it had 0 bytes of data.

As the first commandment states, you should not divulge any helpful information in this forum such as the software used or the name of the drive in question so you have successfully hidden important information - please always stay on that meta level without giving specific details about your case.

If your WD utility says that your drive has "0 bytes of data" you seem to have a big problem.

And if TestDisk does "work", will that make the recovery process more efficient (I think that answer to that is YES).

Yes.

@recuperation

Thank you for your reply. Yes, I realized the drive was damaged because my friend told me he couldn't access it when plugged into his system. I also realize the best course of action would have been to make a duplicate of the drive (and then work on the DUPLICATE drive, so as not to damage the original - just in case). However, I don't have a spare 1TB drive handy, and the drive I do have (which is not empty) is an SSD drive, so I think cloning an HDD onto an SSD might not be successful due to differing cluster sizes.

I did see somewhere (either in your documentation or on the forum) that there were utilities that could copy the old drive into an .img file, but having never worked with one in the past, I wasn't really sure how to handle that.

Anyway, I have informed my friend that the estimated time for completion is now up to over 8 years, so I am definitely going to abort this process within the next day or so and take the chance that using TestDisk will yield me FASTER results. The worst that will happen is that I damage a few files (I expect I've already processed enough sectors using PhotoRec so that I've gone beyond the area reserved for the File Allocation Table), but the upside is that recovery could be faster and preserve file names. Because this is an external drive, I don't expect it to have a boot sector or multiple partitions. The only information I don't have from my friend is whether he tried plugging this into his Mac computer and then tried to move files to it (without formatting the drive to be Mac compatible) or if the delay in its operation speed is due to some other form of damage.

EDIT: I don't use Apple equipment, so I wonder if you could tell me, @recuperation, if my friend DID plug this WD drive into a Mac and tried to move or copy/paste information from a mac onto this WD drive, would the mac have recognized the filesystem already on the WD drive and accessed it appropriately; or would it have assumed that the filesystem was already mac-compatible, and therefore messed up during the file transfer? Alternatively, if the file transfer actually WORKED (and I have no way to know), is it possible that the errors I'm seeing may be due to the possibility that the drive was formatted for a mac-compatible filesystem, and therefore it appears to ME to be damaged (when plugged into a PC or Linux box), even if it's not really damaged?

JEfromCanada wrote: 01 Jan 2022, 00:14 @recuperation

However, I don't have a spare 1TB drive handy, and the drive I do have (which is not empty) is an SSD drive, so I think cloning an HDD onto an SSD might not be successful due to differing cluster sizes.

Cluster size is a property of the secret file system that you did not mention but not a property of the drive.
If it is not an expensive enterprise drive or an external drive that came with a housing both will have a sector size of 512 bytes. => Duplicating should not cause problems.

I did see somewhere (either in your documentation or on the forum) that there were utilities that could copy the old drive into an .img file, but having never worked with one in the past, I wasn't really sure how to handle that.

Starting using Linux is strongly recommended.

EDIT: I don't use Apple equipment, so I wonder if you could tell me, @recuperation, if my friend DID plug this WD drive into a Mac and tried to move or copy/paste information from a mac onto this WD drive, would the mac have recognized the filesystem already on the WD drive and accessed it appropriately; or would it have assumed that the filesystem was already mac-compatible, and therefore messed up during the file transfer? Alternatively, if the file transfer actually WORKED (and I have no way to know), is it possible that the errors I'm seeing may be due to the possibility that the drive was formatted for a mac-compatible filesystem, and therefore it appears to ME to be damaged (when plugged into a PC or Linux box), even if it's not really damaged?

As you have very well hidden the file system used I can't tell you. Even if I knew the file system, I don't know if Apple computer understand the one you/your friend used.

I smelled a rat when you said that the drive shows up with a size of zero bytes.
Providing a smartmontools log file appears crucial and if duplicating as described in the manual fails consulting with a professional recovery company might be necessary.

As your posts are pretty lengthy but do not show the interesting information needed I repost a catalog of questions that I compiled for fun to tell you which information matters:

1.Which operating systems can be booted from your computer where the incident happened?
List them all!

2. Which version of Testdisk do you use?

3.Do you prevent/reduce write access to the failed drive/file system?
[Yes/no]

4. If yes, how is that done?

[ ] I removed the failed drive and connected it to another computer (not linux) as an external drive => risky
[ ] I am using a live linux from a USB stick on the machine with the broken drive => good
[ ] I am booting a linux system on a different system and connect the drive externally once the linux finished booting => good

5. Is the broken drive a drive where an operating system resides on or is it a data drive?

6. What technology is your drive (HDD, SDD, USB stick, Compact Flash card, SD card,...)?

7. What is the size of your drive?

8. What is the maker of your failed drive?

9. What is the model?

10. Is the drive something you bought "naked" one or does it come with a housing and a connector for a computer (p.e. like "WD My Passort")?

11. If possible, provide a logfile from smartmontools!
Instructions:
viewtopic.php?f=5&t=10910

12. What has been the partitioning scheme used on the failed drive (MBR (old partition table style), GPT, Superfloppy)

13. How many partitions have been on the broken drive, what was their size, what was their file system?

14. Is your drive visible in your operating system (Windows: Disk management, Linux use lsblk command, get information using hdparm command)

15. Is the partition scheme containing your partitions still visible?

14. Describe the supposed event when your system went from "OK" to "broken"!

15. Is your disk showing signs of failures such as
-clicking noises
-permanent reboot (spindel speed up followed by a stop)
-no spindel speed up

?

16. Do you use encryption, if yes, which one?

17. If you use encryption, what is the scope?

[ ] full drive
[ ] partition
[ ] file container
[ ] single files

I am learning too, but one thing I have got right is cloning the drive.
The free version of AOMEI Partition Assistant allows you to clone sector by sector to a destination drive without limitation.
https://www.aomeitech.com/pa/standard.html

AOMEI detects drives without an assigned drive letter and in its RAW state.

Method - destination drive.
Prepare the destination drive.
Disconnect all other data drives to avoid working on the wrong drive.
zero fill in full mode. (Not quick)
This is to remove any data traces as a precaution and check the drive is good.
There is no requirement to partition or format the destination drive.

Method - Clone
Boot with the source and destination drives connected
RUN AOMEI, Disk Clone and clone sector by sector.
Make sure your destination drive is the correct one.
Don't assume the physical SATA ports are always in order of Disk 0. Disk 1, Disk 2.
diskPart "detail disk" is helpful to identify.
or eg Right Click on AOMEI disk 0, properties will provide basic drive information.
The destination drive must be the same or greater capacity than the source drive in MB.
You need to check.
Ensure when booting Windows does not try and auto fix the drive. You can press a key to bypass it.
Don't use Chkdsk.

I use TestDisk for data recovery.

As long as don't know for sure what your preferred cloning tool really does when it hits a unreadable sector, your cloning tool is worthless.