Restore data on unallocated space

Question

I'm trying to recover a deleted partition. The partition can't be restored from the partition table.

I've tried EaseUS Data Recovery, which finds files but crashes halfway through. I've also tried Find and Mount which doesn't seem to find anything, not even valid partitions on the drive.

My questions:

1. What tool would you recommend for recovering data in unallocated space?
2. Would it be harmful to write a new empty partition over where the data used to be to try another recovery tool?

Answer 1

Never write anything to a disk you are trying to recover data from

Also, if possible, make an image of the disk with dd, ddrescue or whatever suits you.

Download a linux live cd (I strongly recommend System Rescue CD)

Use testdisk to recover the old partition table. This would be the basic steps:

1. Run fdisk -l to find out your disk device node
2. Run testdisk </dev/sdX> replacing accordingly
3. Selectthe partition table type (usually Intel)
4. Select the Analyze command

From here on, it depends on whether it found your lost partition and it's recoverable. Follow the step by step guide for more detailed steps.

If testdisk didn't manage to find your lost partition, chances are part of the information got overwritten. A good choice now would be to use photorec to try to recover as much files from it as you possibly can.

photorec will read the disk bulk and use heuristics to recover as much files as it can from the raw data. It will be up to you then to browse through the recovered files and find what's useful and what's not.

Both testdisk and photorec are included in System Rescue CD.

EDIT:

You could also try to make an image of the unallocated space only, and run photorec on that image. It should be faster. I assume you already have an image of the disk at image-file:

bash # sfdisk -l -uS image-file

Disk image-file: 0 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0

   Device Boot    Start       End   #sectors  Id  System
image-file1   *      2048    206847     204800  83  Linux
image-file2        206848   4401151    4194304  82  Linux swap / Solaris
image-file3       4401152 312581807  308180656  83  Linux
image-file4             0         -          0   0  Empty

So from this info we know the block size is 512 and the last partition ends at 312581807. We need to extract from there on:

dd if=image-file of=unallocated-space bs=512 skip=312581807

Source.

Answer 2

Writing data to the disk, especially in the area where the lost partition is supposed to be, is obviously harmful.

The disk is a big sequence of sectors, normally 512 bytes each. The partition begins on one of these sectors. The contents of the partition is a filesystem. The first sector of a filesystem can normally be recognized as such because of its structure; for instance, on FAT filesystems, the first sector is called the boot sector and contains some fields which identify, in particular, the filesystem length.

The recovery strategy would look like this:

1. Boot up the machine with a Linux live CD. Don't write anything to the hard disk.

2. Run some script or program which repeatedly reads sectors from the raw device (normally called /dev/sda or /dev/hda, or something similar, depending on the type of disk and the machine hardware configuration). For each sector, try to see if it could be a boot sector for a FAT filesystem, and, if yes, extract its length.

3. If you find your filesystem that way, copy it onto a new disk as a file (this is easily done with the dd command-line tool), then try to mount it as "loopback".

All of this is relatively easy a developer with some Linux skills. This document may help you, and point to some useful tools for that.