Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My 120GB laptop disk has crashed and is no longer bootable nor readable by Windows. I was running Windows XP Pro SP3 on it (sole partition).

To save embarrassment let's just say that my last backup was more than one week old! (...and I am planning a new PC with RAID-1)

Ideally I would like to recover 3 files with this priority:

  1. a 25MB Access2003 file (in particular the VBA source code)

  2. a different 25MB Access2003 file (all of)

  3. a 250MB outlook.pst file

I have put the disk in an enclosure and run TestDisk which identified the partition and told me that the root folder and MFT are not readable.

So I got TestDisk to dump it to a ~117GB dump file on local disk.

The source code I want should be located in a handful of 4K clusters. It seems that VBA source code is stored as ordinary non-Unicode text (but with more than "cr-lf" line separators)

I had made numerous copies of File #1 (i.e. "Copy of ...") most of which likely reside on the disk, either in the same folder as the latest version, or in the Trash, and if I could recover any one of them it would likely contain the source code I had not backed up.

Are there any recommendations on how to either:

  1. attempt to reconstruct the files (given that root folder and MFT are munged)? - perhaps software which examines the NTFS log?

  2. quickly search the complete disk dump file for source code ? - i.e. a fast viewer with search facility

share|improve this question

migrated from stackoverflow.com Oct 22 '12 at 1:26

This question came from our site for professional and enthusiast programmers.

2 Answers 2

I'd suggest grabbing a copy of the disk using a forensics or recovery oriented version of DD and working off that. Testdisk isn't the right tool for this job IMO. Always work on an image rather than the real drive

The first thing I'd try is to use prodiscover basic under free tools to see if that picks it up, It'll read a disk image directly, and runs on windows.

If that fails, you need to grab the heavyhitters The 'class' of tool you're looking for is called a 'carver' and uses file headers to find files.I'd recommend doing it on linux cause these are linux native tools. Scapel and foremost are what I suggest. Read the manpage for usage instructions, and check out a few usage guides online (such as this and this). These are not easy tools to use, and if the file types you are using arn't there, you may need to find the headers and footers of filetypes.

share|improve this answer

Advanced filesystem reconstruction is quite difficult for open source tools, when it comes to NTFS. In this case, a commercial (but not very expensive) tool such as Restorer Ultimate may give quite better results.

That software actually has a demo mode which recovers small files for free. In the case of source code files they could end up being recovered without even buying the license. The program is for Windows but it runs under Wine.

If you want to manually search the image file, since source code is plain text, you could use grep and with the binary switch and get the offsets with:

grep -abir "int main("

The above is just an example of a string which appears in C source code. I don't know VBA so I can't suggest on patterns for that language.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.