I used TestDisk to recover files from an internal hard drive which I connected externally to another PC. With PhotoRec all the file names are wrong and the original folder structure doesn't exist.

What can be done?

  • 2
    Data that can't be recovered, can't be recovered. – Tom Wijsman Apr 17 '12 at 1:10
  • His issue probably isn't with data being recovered, its probably with carving and selecting data since testdisk takes a naive/aggressive approach to file recovery. It tends to ignore the filesystem and just collect and reassemble chunks of image data. – Journeyman Geek Apr 17 '12 at 1:57
  • agree with you, test disk and photorec need to make easier for recovering files with its file structure and file names. – Sidhi Ciang Nov 26 '13 at 19:25

Photorec does do that, its one of the more annoying things about it, but its meant to recover files in scenarios where its more important to get the data.It often is able to rebuild images from fragments in situation where commercial software can't. As such i tend to run recurva first (it preserves filenames) THEN testdisk in a recover scenario. (practically its "Load in another OS with a different file system driver implementation - windows for ext, linux for ntfs, testdisk, recurva then photorec)

You can't recover the folder structure, but you may be able to rebuild the filenames off other data. There's a section on photorec's documentation that has some scripts that are useful for doing this sort of recovery, using exif and other metadata.

  • Pandora Recovery will preserve folder structure. – Joel Coehoorn Apr 17 '12 at 2:03
  • Ok thanks. I'm not so techsavvy. Windows 7 doesn't recognize the external harddrive. So I cannot select it with Recurva. It does show up in Testdisk though. What should I do? – Supra Apr 17 '12 at 2:13
  • In Computer Management -> Storage -> Disk Management it says "Disk 2 Unallocated". – Supra Apr 17 '12 at 2:32
  • see if the disk can be read on linux, then run through the testdisk walkthrough. Most windows only recovery software won't work in that scenario – Journeyman Geek Apr 17 '12 at 3:00
  • Sorry I don't have Linux. – Supra Apr 17 '12 at 3:59

One thing I personally took upon myself is to collaborate with the author of photorec to find PAR2 files. He got right on it and added PAR2, but you have to set photorec to recover incomplete files for PAR2 because you'll want to get as much of the file as possible, rather than having it ignore the file if there is a filesize mismatch. If you pre-emptively create PAR2 data, even just 1% of recovery data, with small recovery blocks, spread out over 10 files for an entire directory of files, you'll have just added an enormous advantage to recovering your date, contiguous and fragmented, and the filenames and directory structures, if you're able to recover some of those PAR2 files with Photorec. (or whatever data recovery/file carving software). This works best for media/read many, write not-so-often drives, where you can easily defrag, and not have to worry much updating PAR2 Data.

This won't help your current situation most likely, but I would try programs like "Recuva" which is free, and two commercial programs, "Easy Recovery Pro" and "Zero Assumption data recovery" are some excellent programs to help you recover data. Be careful not to write to the disk until you have made a nice mountable image of the disk with testdisk that you can play with. Depending on the problem, it may be as simple as restoring a backup copy of the file allocation table, or using one of several partition utilities to do a "recover partition" on the damaged drive.

PhotoRec is another beast. While Testdisk can often outright "unedelete" or restore entire partitions or File allocation Tables for various file systems, it doesn't actually do any "searching" for files. PhotoRec combs every sector and/or cluster the hard drive looking for headers of filetypes it it has it it's database, to try to find various filetypes, but it ignores the Filesystem. So you could be using NTFS to nearly any flavor of Linux filesystem and get pretty much the same results. Only problem is, if you use compression in your filesystem, like NTFS compression, or BTRFS compression, or whatever, it will not be able to find those lost files. Your best luck us to try to reconstruct the filesystem in that case. But the files it DOES fine, it has no reference from which to name the files, since it is doing a bare-metal search for data, independent of the filesystem which kept track of all the metadata such as filenames, the locations of files, etc..

You can try and rename files based on metadata recovered from within files, such as JPEGs, or other media. Future approaches, I would heavily recommend adding PAR2 data. MultiPAR or a recent build of Par2CMDLine is highly recommended as they both support recursive subdirectories when building PAR2 data. It's good to build around 10% recovery data, drive space pending. And to refresh the PAR2 data monthly or weekly at least. But it's well worth it. Also, An excellent idea to keep your drives defragmented so your files are contiguous and much more likely to be recoverable if a filesystem failure occurs.

If a filesystem occurs, you can use TestDisk to make a DD file and recover the data from the .DD file rather easily using the PAR2 files extracted using PhotoRec.

Addition: Please forgive the late reply and my terrible composition style. Here are some links that may be of use. Most of the software titles I have mentioned are easily found via. Google search as well.

Addition: Another method might be to use TestDisk to make a raw .dd file of your hard drive to another hard drive, then using a disk mounting utility such as OSFMount, and mount the image as a virtual drive. There are a few utilities which will let you mount disk images as virtual drives, and even read-write to them is if they were actual hardware devices. OSFMount, is just both free and effective for forensic data recovery. The website states the following about OSFmount, "OSFMount is a free utility designed for use with PassMark OSForensics™, "OSFMount allows you to mount local disk image files (bit-for-bit copies of a disk partition) in Windows with a drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the mounted volume's drive letter." You can download the 32bit or 64bit versions for Windows here: http://www.osforensics.com/tools/mount-disk-images.html

Once you have your drive image made, and mounted to an image, you can to risk-free recovery attempts on the virtual drive image. There are many data/partition recovery software available. One good place to start would be with EaseUS Partition Master Home/Free Edition. But it is just as easy to find by doing a Google search for "EaseUS Partition Master Free" Again this is one of many similar tools, but it's free and it's quite effective when it comes to reconstructing a damaged partition and recovering files, even those which have been compressed using NTFS compression.

  • Hi and Welcome to Super User! Please read the How to Answer a Question Guide. Could you add some links to the things you reference in your answer? Also try breaking it up, it's a little tough to read. – slm Apr 11 '13 at 12:03
  • @slm Seems like Tim Omaha joined just to answer this question. Too bas he hasn't replied. It'd be nice to get more info on PAR2 files. Never heard of it before. – trusktr Nov 11 '13 at 22:32
  • 2
    @trusktr - yes, given it's been over 6 months I wouldn't expect any. If you're interested in fleshing out the answer more with links etc. feel free, you can make the edits as suggested edits and they'll get approved, and become part of the answer. – slm Nov 11 '13 at 23:11
  • Parchive: Aged page will PAR software and information. Software is dated but may still be of use for information. parchive.sourceforge.net – Tim Omaha Nov 27 '14 at 3:23
  • QuickPar: Was the first real PAR2 program that made it easy to make PAR2 files, and then use them later to "carve" the data out of a something like, a raw drive image, and also recover any additional PAR2 data from the set from that lump of data and use it to further aid in data recovery. QuickPar, unfortunately does NOT support saving or reconstruction of directory structures, only filenames. It is also somewhat dated, as it seems to be abandoned since 2004. quickpar.org.uk – Tim Omaha Nov 27 '14 at 3:23

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.