1

The first 7GB of a 500GB NTFS partiton was accidentally overwritten with another file. Is it possible to recover some of the data in the remaining 493 GB of the NTFS volume? The partition table is intact. The executed command was:

dd if=file of=/dev/sdc1

Thanks

Edit: My question is different. I overwrite first 7GB of NTFS partition. Other question mostly deals with hardware failures or bad sectors.

migrated from stackoverflow.com Nov 16 '16 at 21:04

This question came from our site for professional and enthusiast programmers.

2

SOLUTION: None of suggested solutions worked for my case. I partly solved my problem with RecuperaBit. RecuperaBit could recover a lot of small files, including important ones. But it failed to recover big (bigger than 1 GB) files.

In my opinion, only RecuperaBit solution should be advised such (beginning of NTFS volume overwritten) cases.

Thanks to everyone answered and tried to find a solution for me.

  • There is no hardcoded limit on file size. Most likely your file had NTFS compression enabled. – Andrea Lazzarotto Nov 25 '16 at 17:10
1

On linux you can recover all the files in the not overwritten part with https://help.ubuntu.com/community/DataRecovery/NtfsUndelete

There are also similar tools for windows.

Very important is, that you do not write anymore to the disk, also restore the files to another disk. Otherwise you limit your chances of success.

  • ntfsundelete gave me this error: # ntfsundelete /dev/sdc1 NTFS signature is missing. Failed to mount '/dev/sdc1': Invalid argument The device '/dev/sdc1' doesn't have a valid NTFS. Maybe you selected the wrong device? Or the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around? – coolman Nov 16 '16 at 21:53
  • This tool cannot work if the file system is damaged. You can e.g. use RecuperaBit which I developed for that purpose. – Andrea Lazzarotto Nov 18 '16 at 1:06
  • @AndreaLazzarotto thank you for developing RecuperaBit. I can recovered a lot of valuable data with it. On the other hand it cannot recover big files. It shows big files name but file size as 0. Is there any way to recover big files? Thanks – coolman Nov 25 '16 at 16:42
  • @coolman There is no limitation on the file size you can recover. It doesn't work if NTFS compression is enabled, but that's clearly written in the warnings when running the program. Also, NTFS compression is disabled by default on every version of Windows. – Andrea Lazzarotto Nov 25 '16 at 17:09
  • For large files the possibility, that one of the sectors in which the file was stored is overwritten is much higher. Thats why you are able to recover many small files, but less likely to succeed with big ones. – edlerd Nov 26 '16 at 9:31
0

You would have to use a program like TestDisk to undelete files from your NTFS partition. EDIT: Although if you have a native program installed, as mentioned by edlerd, you may want to go with that instead

It's hard to say what data will or won't be available to you, but as long as you didn't overwrite all of it, I think you should be able to find some stuff.

Disclaimer: I haven't used TestDisk myself. It was the first result when I Googled "linux tool recover deleted partition". I have used similar tools in the past, however - you may want to shop around and see which you trust the most/find the most comfortable to use.

  • This won't work if parts of the MFT are damaged. – Andrea Lazzarotto Nov 18 '16 at 1:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.