Page 1 of 2

HELP Needed (This is not a bug report)

Posted: 25 Apr 2015, 18:37
by firefoxjet
Please remove this thread after some time. I am posting it with the hope to get some help to my BIG problem.

First of all, I am stupid..., yes, I am stupid.

I was installing the Kiosk Edition on a USB drive. I did it many times and it works well. Unfortunately, this time I have not realized that I had connected to my PC also a 1TB USB HD with important documents... I connected the USB drive I wanted to install Kiosk on, I opened Konsole and I used the "dd" command to transfer the ISO on the USB drive but, unfortunately for me, I pointed to the USB HD instead. As a consequence the MBR of the USB HD got reset...

I am stupid also because I do not have a safe copy of that USB HD, where I had very important documents...

At this point, I know that most of the USB HD data have not been physically erased, only the portion where the Kiosk has been installed (61MB) but I can not see any more the original data (yes, I know that the MBR was reset... and the HD now is showing "00" for about 950GB...)

Can any one of you try to help me to find a way to try to recover some data from the USB HD? Originally the UDB HD was FAT32 formatted.

Many thanks in advance for your help and sorry to bother you with this problem....

Re: HELP Needed (This is not a bug report)

Posted: 25 Apr 2015, 21:22
by fanthom
hi firefoxjet,

unfortunately i do not have definite answer but please do as follows:

do a backup of your drive first:

Code: Select all

dd if=/dev/sdX of=backup.img
and then use partition recovery function from the testdisk package against your drive. if it wont work then use photorec to find single files. if still nothing then you may ask for help on the parted magic forum:
http://forums.partedmagic.com/
(you have to buy parted magic to be able to register).

let us know if anything worked for you.

Re: HELP Needed (This is not a bug report)

Posted: 25 Apr 2015, 21:56
by donald
1.do what fanthom suggested

2.use a hex-editor which give you low level access on your device and search
for the file headers of the missing files.(use google to get a list of file headers)
If you find files, you can copy them to another place.

If you have a windows pc,use win-hex
I didn't test hex editors for linux,therefore I can't recommend one..sorry.

Re: HELP Needed (This is not a bug report)

Posted: 25 Apr 2015, 22:31
by Ed_P
firefoxjet there exists testdisk apps for both Linux and Windows systems. Use USM to find the Porteus version.

When you installed the kiosk iso did you format the usb drive too? Can you post the dd command you used?

Re: HELP Needed (This is not a bug report)

Posted: 26 Apr 2015, 13:46
by beny
well if i have undestud the usb hd not have an operative system ,you have installed porteus on,so you have tried to start from the usb hd,maybe the system run,if this fails you know the brand of hd ,you have to see if there is a software that allow you a recovery of partition table,the problem with the hard disk is only the size you have to have a hard disk of the same size to try data recovery task

Re: HELP Needed (This is not a bug report)

Posted: 27 Apr 2015, 01:38
by brokenman
Just 3-4 days ago I overwrote the partition table on a drive using dd (ironically names disk destroyer) and hosed a windows installation. I was able to recover the data from it.

I am not sure if you ONLY wrote over the partition table on the drive. Without seeing the exact dd command you used it is impossible to know. In any case I was able to recover the data. I had two partitions on a 320Gb drive. I needed to save data from the first. I recreated a partition that I knew was a little bigger than the first (using cfdisk) and then wrote the partition table to the disk. I DIDN'T format the partition. This allowed me to mount the partition from Porteus and recover the data.

I do highly recommend using testdisk to do this.

Re: HELP Needed (This is not a bug report)

Posted: 27 Apr 2015, 21:13
by firefoxjet
Dear All,

Please find here an update on my attempt to recover data from the USB HD.

First, let me thank all of you for your kind contribution.

For the record, please find here the dd command issued by mistake:

dd if=Porteus-Kiosk-3.3.0-i486.iso of=/dev/sdq

the command is correct, my problem was that....I did several installations that day on a USB sick. Every time I was using different Kiosk configurations, taking the sick out and using it to restart another computer for testing purposes. So, each time I wanted to repeat a new test (new Kiosk configuration) I inserted the USB stick in my primary computer and I received a different sd(x) name (sdb, sdc, sdd, sde, etc.)
While doing that, I noticed that not all the time I was receiving a new sd(x). From time to time, and I do not why, the same (previous) sd(x) was given to the inserted USB stick.

So now I come to my fatal error. At a certain point I inserted my USB HD because I was in need of some information. Then I forgot that the USB HD was still connected. I did not pay also attention that, at time of insertion of the USB HD, I received the last (previous) sd(x) -- for clarification lets imagine it was sdq. Then I inserted the USB stick and Porteus gave it sdr. I opened Konsole and I pressed <Arrow Up> to recall the last dd command, I noticed that it was pointing to sdq and not to sdr, thereofre, I was going to change the last letter but, unfortunately for me, I touched by chance <Enter> and the command started. I heard the start of the USB HD and it was already too late.... :wall:

What I did after: First of all I was mad at me.... :evil: for the mistake and for not having a safe copy of that USB HD.
Then, I took another USB sick, formatted it FAT32, copied on it several folders with some files. Then, I issued on it the same dd command. Kiosk was installed. Then I went on Google to look for "Data Recovery Tools." I found one for Windows called Disk Drill from Clearfiles. I created a W7 virtual PC in VirtualBox and installed Disk Drill on it. I connected the test USB sick and requested Disk Drill to recover the content. All files were recovered with names such as File001, File002, File003. Files were grouped in sub-directories by file type. Good news!
Then, I launched the rescue mission here on the Forum, with the hope to find a better way to recover data.

I am talking about a 1TB HD full at 99%. It means that, at the end, I will recover more than 300.000 files, all with not a clear meaning name to me (File001 is not any more the original name in the original sub-folder), therefore, it will be almost a "mission impossible" to open each file to rename it in something meaningful. Even if I can manage to rename 1000 files per day, it will take me about 300 days!

Well, of course, it is better to recover data than having lost it for ever.

Currently, I am running Disk Drill against my USB HD and it is working fine. It has already discovered 50% of the HD content (already running since the incident date). As soon as it has done the discovery phase (two more days), I will connect a new USB HD and recover the content on it.

With my test USB stick, I tested also the software recommended by Fanthom (testdisk) and used photrec. I also successfully recovered my test data (single files).

At this point, I know I will recover most of my data. All human readable data such as pdf, doc, xls, jpg will be safe and it will just take my time to try to rename it to a meaningful name. I noticed that photrec, recover files with file001(xxx) where xxx is a portion of the original name, therefore, it should make my life easier when I need to understand the content of the file. Therefore, I will also use photorec to recover my USB HD a second time and I will let you know the result here.

On the same HD I had several Windows software, divided in each sub-folder. I let you imagine now that software with names such as file001 will be of no use.

@brokenman: You mentioned you suffered of a similar incident. You say you were able to recover data recreating the partition on the disk. Did you were able also to see again your original data in the original sub folders with the original names? If yes, I will give a try too. Please let me know.

Guys, sorry for the long explanation and thanks again for your kind help.

I love Porteus. It is a great distro and the Kiosk idea is great too.

I keep you posted.

Cheers.

Re: HELP Needed (This is not a bug report)

Posted: 28 Apr 2015, 00:25
by Bogomips
Am not able to follow the explanation. Were the partitions adjacent to each other? Had parted to be used? And why the partition of the lost data had to be bigger the second time.

Anyway it's an interesting adventure. This file001, file002 business is just too trying, and had to give up after a while. Clobbered a directory. Interestingly enough 1TB h/d was recently subject of discussion, and donald had mentioned the almost impossible task of backing it up, whereas actually I had it in mind to use as a backup.

Inadvertently to lose data is not so difficult, nightmare of being in root terminal, do a copy and paste of previous instruction, only to find copy had not taken and many many lines of previous copy of commands, taken for documentation purposes, being executed! In this instance there could be scores of random changes happening all over the place. Whole disk could be compromised =@

Re: HELP Needed (This is not a bug report)

Posted: 28 Apr 2015, 00:46
by Rava
firefoxjet, it is adamant that you do not write any more data to the data-damaged external hard disk.

Like written above, you need another hard disk that is free, no data on it whatsoever, and with a partition at least the size of the damaged partition. But it has to be a Linux partition (ext2, ext3, ext4, reiser-fs etc) cause Wind. Partitions cannot create files that large, and the dd above would copy your whole partition into one single file, then using testdisk or photorec to recover any data still there is your only chance. (Unless you have lots of bucks to spare to pay for professional data recovery firms, that is)

Re: HELP Needed (This is not a bug report)

Posted: 28 Apr 2015, 04:55
by Ed_P
firefoxjet wrote:All files were recovered with names such as File001, File002, File003. Files were grouped in sub-directories by file type. Good news!
That's the same naming convention that Windows' CHKDSK uses to recover "files". I quote "files" because the CHKDSK "files" are not files but the segments of files stored on the hard drive. Unless the files are contiguous. Putting the CHKDSK "files" back together to represent the original files is a nightmare. Been there, done that, on a whole lot smaller hdd that what you are talking about.

I wish you well firefoxjet. And I hope Disk Drill is better than CHKDSK.

Re: HELP Needed (This is not a bug report)

Posted: 28 Apr 2015, 05:18
by Rava
Ed_P wrote:That's the same naming convention that Windows' CHKDSK uses to recover "files". I quote "files" because the CHKDSK "files" are not files but the segments of files stored on the hard drive. Unless the files are contiguous. Putting the CHKDSK "files" back together to represent the original files is a nightmare. Been there, done that, on a whole lot smaller hdd that what you are talking about.
Now I am curious, have you done the same with testdisk or photorec?

Cause all times I tried it failed, like, completely... :cry:

Re: HELP Needed (This is not a bug report)

Posted: 29 Apr 2015, 13:04
by firefoxjet
*** Update ***

Disk Drill sofware has completed the scan of my 1TB USB HD. It found 116.932 files for 553GB. Currently I am saving the files to a new USB HD and after that, I will use photorec to perform the same action. I want to test how long it will take to perform similar action.

I am interested in finding a software that can recover the files in the original sub-folder, making my life easier at time of discovery and possible, keeping the original name and not File00001, File00002, etc.

@fanthom: You recommended to use testdisk to rebuild the partition. I tired to do so on my test USB stick but I did not manage.
I first formatted the test USB stick (1GB old stick) as FAT32. Then copied some folders on it with docs, pdf and ppt data. Then I installed on it Kiosk 3.3. Then I inserted the USD stick into another PC, I booted Porteus 3.1 32Bit Always Fresh and downloaded testdisk form USM. I launched testdisk, selected "create" log. Then I found the test USB sick on /dev/sdb, I pressed "Proceed".
Then I have the option to choose from different partition table type. The default value is "None". I selected "None". Then "Advanced". Then I can see that the current partition is ISO. I change the type in FAT32, then I try "Undelete". Result, no Files Found.

I repeated the same steps selecting partition type "Intel". Same result.

Am I doing something wrong? I launched also the "Analysis" function with no result.

Many thanks in advance for your kind support.
Cheers.

Re: HELP Needed (This is not a bug report)

Posted: 29 Apr 2015, 15:54
by fanthom
@firefoxjet

dd starts writing from very first sector destroying partition table completely and all data in first 60-70 MB. testdisk would succeed if you had more than one partition. it would find other parts but not the first one.
this is what i think but i'm not recovery expert.

I am interested in finding a software that can recover the files in the original sub-folder,
you should do what brokenman said:
create new partition table and select one partition for the whole disk.
DO NOT format it.

when you boot Porteus it should mount your drive as normal but i guess that many files will be still damaged as their parts are spread across whole partition including first 61MB.
please test this method on some other stick before you use it on a target drive.

Re: HELP Needed (This is not a bug report)

Posted: 29 Apr 2015, 17:00
by Ed_P
Rava wrote:Now I am curious, have you done the same with testdisk or photorec?
I have used testdisk to repair a broken partition table and I had expert help doing it. And I have recovered deleted files using photorec.

The problem is files are rarely all stored cluster after cluster. They are stored where ever free space is available and not necessarily all in ascending sequence. Without the FAT indicating the begining cluster utilities like CHKDSK simply recover non-zero clusters, one after the other, and unless a file is smaller than a cluster, 4K, 8K, the recovered clusters are like pieces of a jigsaw puzzle.

And if I'm not mistaken, the FAT can be located away from the Partition Table.

Re: HELP Needed (This is not a bug report)

Posted: 30 Apr 2015, 01:37
by Rava
Ed_P wrote:And if I'm not mistaken, the FAT can be located away from the Partition Table.
When I recall right, there are several copies of the FAT, but knowing SM Windoze, * cough* I mean MS Witless of course 8) they put all these copies at one place, for more easy corruption. :wall:

@rest of your post
I know, that's what makes it tricky, when the directories itself are lost then there is less rejoicing but large guessing starts.
Still, Photorec and testdisk make a way better job that chkdsk, And chkdsk is not a free (as in beer) software.