File recovery (testdisk/photorec)

Recover a formatted/corrupted partition (testdisk)

References

Install testdisk

sudo apt install testdisk

Recover a partition

Only follow these steps if your partition has been formatted or corrupted and you cannot see any files:

  1. First steps

    1. If this is an external drive, verify the drive is connected

      $ lsusb
      Bus 001 Device 008: ID 0930:6545 Toshiba Corp. Kingston DataTraveler 102 Flash Drive / HEMA Flash Drive 2 GB / PNY Attache 4GB Stick
      
    2. List the partition table

      $ sudo fdisk -l /dev/sdb
      
      Disk /dev/sdb: 15.6 GB, 15606349824 bytes
      64 heads, 32 sectors/track, 14883 cylinders, total 30481152 sectors
      Units = sectors of 1 * 512 = 512 bytes
      Sector size (logical/physical): 512 bytes / 512 bytes
      I/O size (minimum/optimal): 512 bytes / 512 bytes
      Disk identifier: 0x00000000
      
      Disk /dev/sdb doesn't contain a valid partition table
      
    3. Try to mount it

      $ sudo mkdir /mnt/sdb
      $ sudo mount /dev/sdb /mnt/sdb
      mount: you must specify the filesystem type
      $ sudo mount -t vfat /dev/sdb /mnt/sdb
      mount: wrong fs type, bad option, bad superblock on /dev/sdb,
             missing codepage or helper program, or other error
             In some cases useful info is found in syslog - try
             dmesg | tail  or so
      
  2. Prepare the drive to be recovered

    1. Testdisk will modify the drive to be recovered. If you have enough space, it’s best to create an image of the drive/partition and work with that instead:

      sudo dd if=/dev/sdb of=~/Desktop/flashdrive.img
      
    2. If creating an image of the drive isn’t possible, unmount the drive to prevent anything else from writing to the drive if it is mounted:

      sudo umount /media/flashdrive
      
  3. Run Testdisk

    • To run Testdisk on an image

      sudo testdisk flashdrive.img
      
    • To run Testdisk on a drive

      sudo testdisk /dev/sdb
      
  4. If asked, select Create to create a new log file

  5. The drive to scan should already be selected. Select Proceed

  6. Select the partition table type. The default value should be the correct one as Testdisk auto-detects the partition table type

  7. Select Analyse > Quick Search

  8. If you see:

    The following partition can't be recovered:
         Partition               Start        End    Size in sectors
    >  HPFS - NTFS          14882  63 32 29765  62 31   30480352
    

    Select Continue > press Enter > Deeper Search > Continue

  9. For each partition that is listed:

    Disk flash-drive.img - 15 GB / 14 GiB - CHS 1898 255 63
         Partition               Start        End    Size in sectors
    >  HPFS - NTFS              0   0 33  1897  80 39   30480352
       HPFS - NTFS              0   1  1  1896 254 63   30475242
    

    Highlight the partition using the arrow keys and press P to list the files > Quit

  10. If none of the partitions found shows a list of files, press Enter > Quit > Quit > Quit. The partitions cannot be recovered.

    • If you wish to instead recover individual files, follow the instructions below (photorec). Unfortunately Photorec will not recover filenames or folders. See instructions below if you wish to recover filenames or folder structure.
  11. If any of the partitions found shows a list of files, highlight the partition and press Space (the highlight should turn green and there should be a P for primary partition or * if you’d like it to be bootable) > Enter > Write > Y

Recover filenames/folders from formatted/corrupted partitions

If Testdisk was unable to recover the partition, you still may be able to get a list of the files on the drive if you have a Windows VM running in Virtualbox:

  1. Convert the disk image to a Virtualbox image file. See: VirtualBox

  2. Attach the Virtualbox image file to the Windows VM and boot it

  3. Download and install one of the following programs depending on your need:

    • ZAR
      • “In digital image recovery mode program operates as freeware with no functional limitations.”
      • Doesn’t seem to recover folder structure, but does recover some filenames (Is this still true?)
    • R-Studio
      • Seems to do a good job of listing the files and folder structure
      • The demo version can only recover files < 256 KB

Recover files (photorec)

Install photorec (part of the testdisk package)

sudo apt install testdisk

Recover files

  1. Create a new folder somewhere to store the recovered files

  2. Connect the drive/insert the SD card to recover files from

    • To prevent overwriting the files you wish to recover:
      • If it’s an SD card, lock it before inserting it
      • If it’s a hard drive or partition, unmount it (after connecting it if it’s an external drive)
  3. Run photorec

    photorec
    
  4. Select the drive to recover files from

  5. If desired, go to File Opt and only select the file types you wish to search for

  6. Select the partition to recover files from and go to Search

  7. Select the filesystem type

  8. Select Free space to recover deleted files

  9. Browse to the destination folder and press C to begin recovering files

Fixing recovered .mov files that won’t play

http://superuser.com/a/962793/93066

  1. Sort the list of recovered files alphabetically

  2. If a file ending in .mov is immediately followed by a much smaller file ending in _ftyp.mov, it can likely be fixed; the _ftyp.mov file contains header information

  3. To fix the video, combine the two files, placing the header file first. Ex:

    cat f2951104_ftyp.mov f0195200.mov > video.mov
    

Put recovered files in subfolders by extension

for file in recup_dir.*; do extension=${file##*.}; mkdir -p $extension; mv $file $extension; done

Other

Recover text from a corrupted document

strings file.doc > file.doc.txt