cgsecurity.org

Hi. So first of all, I just want to thank the people here at cgsecurity for making this program and forum to help people. I really hope that someone can show me how to recover my files with photorec.

Okay, so here is my situation:

1.) I accidentally shift-deleted (permanently deleted) 4-6 large video files on my linux ubuntu partition. They were around 4 GB each but I'm not 100% sure.
2.) I shut down my computer and downloaded ubuntu rescue remix cd on a completely different computer (didn't want to risk any overwriting by installing testdisk onto the partition with the deleted files).
3.) I booted using the rescue CD and booted into live mode.
4.) I ran photorec and followed the directions of the wiki all the way up to the point of selecting a destination for the recovered files. (In file options, I unselected all file types except .ts files)

Now here are my questions.

1.) I have 2 hard drives in my computer. Let's call them HDX (750 GB) and HDY (500 GB). HDX is one big linux partition and it is where I deleted the video files. HDY is divided up into 2 partitions; a linux partition with an older version of linux and a windows partition. Since it says to not save the files on to the partition they were stored on, I want to save the recovered files to the linux partition of HDY but I can't seem to access the device. I looked in /media , /mnt , and I looked in /run but /run/media doesn't exist. /dev/disk seems to list my hard drives but I can't seem to select from there. How can I select my other hard drive as the destination folder?

2.) Based on some research I did on the internet, I ran across some people saying that large .ts files caused some problems. Some people seemed to get thousands of small files and another time several giant files. Based on how I described my situation, is there anything similar that could go wrong when I start the recovery? And why are .ts files disabled by default in file options? Is that an implication that the success rate is not so good with .ts files as opposed to other files?

3.) How much space should I have at the destination for the recovery files? The total size of the files deleted were ~20 GB. I have an external USB drive with 100 GB of free space I can use if there is no way to access the other hard drive. Would that be enough? Is there a possibility of any data on the USB drive getting corrupted during the recovery?

4.) Once I start the recovery, is that basically my only chance to recover the files? In other words, if something went wrong (power outage, running out of space at destination), would it mess up the data so that no recovery is possible by running photorec again or even another program like scalpel or foremost?

I'm sorry for the lengthy post but I'm just trying to be as detailed as possible. Please let me know if there is any other information you need. Thank you again.

-Kelly

I'm sorry. I posted this in the wrong section... Can a moderator move it to the 'file recovery' section? I'm using photorec, not testdisk. Thank you.

Can someone please help? I'm scared to even use my computer until this is resolved for fear of losing my data permanently.

Can someone please please please please help me? I shutdown my computer on the 28th and haven't used it in 5 days because I'm just hoping someone can answer my questions. And if nothing else, can someone, anyone tell me if waiting like this decreases my chance for recovery? Or is it the same no matter how long I wait as long as my computer stays shut down?

Please. I don't know what more to say. Even some acknowledgement that someone will assist me in the future. Now I just don't know. I've been sitting in front of my laptop hitting refresh every 30 minutes for 5 days.

It's good that you decided to turn your computer off and not use it. Before trying the photorec route I would try the procedure outlined here first using your live CD

http://www.cgsecurity.org/wiki/TestDisk ... e_for_ext2

When choosing the location to restore, use your external HDD.

kelly wrote:I looked in /media , /mnt , and I looked in /run but /run/media doesn't exist. /dev/disk seems to list my hard drives but I can't seem to select from there. How can I select my other hard drive as the destination folder?

You need to know where your partitions/disks are mounted, if necessary, use the "mount" command in a terminal.

ok, I ran testdisk this morning and followed the wiki for undelete. I navigated to the directory where I deleted the 5 large video files and there were 5 files in it but they were .desktop files and they were very small (~100 kb each). So I tried photorec next and it seemed to work but it recovered like 270 files, ranging in size from a few kilobytes to a few hundred megabytes. I looked at some of them individually on my laptop and it appears that they are all random portions of the original deleted video files. Some aren't even playable.

Is there anyway I can recover the files as they originally were? ~4 GB each?

Try using latest 6.14-WIP, the update from this weekend reduce some mpg false positive.

cgrenier wrote:Try using latest 6.14-WIP, the update from this weekend reduce some mpg false positive.

ok, I will try it, but will that actually recover the files as they were? or just not recover some of the smaller files. I'm not so much concerned about a few false positives as I am about getting the files as they originally were, ~4gb sized...

no settings I can change possibly?

You will have to try and hope the original files weren't fragmented.