2

I have a USB HDD that had been repartitioned (two times), but no data was written to it and only quick format was used to initialize the file system (from Windows 7).

It's a LACIE 500GB,with SAMSUNG HM500JI in it. Assumed partition type was HSF+ (it had been used on a Mac).

I have tried to search for partition information with testdisk, but with no results. I have managed to use foremost and scalpel to extract some files from the HDD.

The question is if I can rebuild filenames and directory structure if partition information was lost or can I only use carving tools?

Improve this question
7
  • what OS are you running? linux i'm assuming since you're talking about foremost and scalpel?
    – RobotHumans
    Sep 21, 2011 at 9:49
  • well, I am doing recovery on a USB drive, running Ubuntu 11.04 in Virtualbox on Windows 7 host, controlling the Ubuntu remotely with teamviewer. :)
    – Unreason
    Sep 21, 2011 at 9:52
  • 5
    First thing to do is image the drive (with dd), don't attempt recovery on the actual device that has the target data on it.
    – James Yale
    Sep 21, 2011 at 9:55
  • @James Yale, that is generally good advice; but that is necessary if one is dealing with failing HDD or if one needs to write to it (also note ddrescue will do a better job compared to dd).
    – Unreason
    Sep 21, 2011 at 9:58
  • 2
    @James is right for this case taking an image before trying recovery is sound advise regardless of if the disk is failing or not.
    – squareborg
    Sep 21, 2011 at 10:17

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .