Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
Best undelete tool for NTFS/FAT?

I was working in windows and decided to reboot. When I reboot, the drive that the windows partition is on is unrecognizable and is not even listed. So I boot into ubuntu. I can not mount the drive and it is never recognized in nautilus. I am pretty sure it is not a mechanical error, for it spins fine, and I can do 'cat sdg'(sdg being it's location) and large amounts of data being spewed out. The only way I was able to detect it is through the Disk Utility program, and it is able to display information about the drive, but it says the drive is unformatted and is 500 GB of undefined. How should I go about recovering this?

EDIT: I just ran the analyze function of testdisk and it was able to recognize the three windows partitions. What should I do from here? I only have enough space available to back up one partition (the only one I care about).
EDIT2: In the analyze screen, it lists two partitions as deleted. One of them being the one i want to recover. How would I recover it?
EDIT3: I have successfully recovered all of the partitions using testdisk. The cause of all this turned out to be a trojan, I think. The drive is now functioning again. Thanks for the help.

share|improve this question

marked as duplicate by Ƭᴇcʜιᴇ007, Sathya Dec 21 '11 at 12:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  

1 Answer 1

up vote 3 down vote accepted

First off, before you try and recover the partition, if you've got enough free space to hold a copy, get an image of what you've got left before you start experiment with recovering it. You mentioned /dev/sdg, so the command below is written with that assumption.

dd if=/dev/sdgN of=/wherever/image_file bs=512

Where N is the number for your windows partition. After that, it's time to break out some software to see what can be recovered. A quick search turns up Active@ Partition Recovery, NTFS Partition Recovery, which are commercial. There is also TestDisk (GPL) (which you found).

Since you're still able to boot Linux, I'm assuming you have some sort of dual boot setup and that your Master Boot Record is intact (if you're not using GPT). Sounds like your partition table has some issues, though. Obviously, your Linux partition(s) are fine, but the entries for your Windows partitions must be missing / damaged / deleted. Backing up your partition table is probably a good idea, see these MBR instructions and GPT instructions.

You can always copy the image back to the device file:

dd if=/wherever/image_file bs=512 of=/dev/sdgN 

Which you would want to do if whatever recovery program you try attempts an in place recovery and fails, possibly making the problem worse.

Be careful with using dd with raw device files, triple check your command lines and devices, or you could damage another partition or your whole drive.

Since you seem to be using TestDisk, check the step by step guide. Check out this screencast, too.

share|improve this answer
1  
YES... Good advice... BU first, THEN work on the fix. –  OG Chuck Low Dec 16 '11 at 18:09
    
What will that command do? I am currently using a 500 GB hard drive, is that going to create a 500 GB image onto my current drive? –  a sandwhich Dec 16 '11 at 18:21
1  
@sandwich: It will create an image file as large as your windows partition. –  Mark Johnson Dec 16 '11 at 18:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.