Recovering data from a damaged disk

Question

So have this problem. Have a 500G disk with data that has crashed. I need to recover the data. I used ddrescue to first create an image and I have recovered 455G to that image. Now, I do not know what the fs of the original disk was (it was linux and mounting the saved image using ext2/3 gives a bad fs error). So when I use a tool like photorec to recover the data, all the recovered files are renamed and somewhat useless to me -- my data files had specific names.

The disk in hosted somewhere else and I do not have physical access. So what can I do?

I used ddrescue from position 300M as I suspect the problem was in the first 200M or so. Anyway I can recover some useful fs info using ddrescue that would enable me to reconstruct a better part of the file system from the saved image?

score 2 · Answer 1 · answered Jun 15 '12 at 11:32

2

File names are not actually stored with the files. File names are stored in a table at the start of the disk called the Master File Table (MFT) it is possible that the MFT has been destroyed or corrupted and can no longer be readable when your harddisk was crash and i guess you cannot get that filename back..

answered Jun 15 '12 at 11:32

mhay

49
1
5

Well, if I remember MFT is only for NTFS? I do not know what the underlying FS is but it is not NTFS.. – Kid_A Jun 15 '12 at 12:28
A similar principle applies to most filesystems though. Directories are usually actually special FILES that have in them a list of file names vs an internal identifier (inode number in unix style filesystems) that references yet another list mapping files to disk blocks. The reason most OS do not let you treat directories as normal files (some unices do IIRC!) even with root rights is that accidentally deleting it would leave the files that were referenced in it on disk taking up space but at the same time inaccessible. – rackandboneman Jun 15 '12 at 13:57

score 1 · Answer 2 · answered Jun 15 '12 at 12:50

1

UFS Explorer is a great tool for this type of recovery. It may help associate names in your case, but i've used it numerous times for tough data corruption and undelete situations.

answered Jun 15 '12 at 12:50

ewwhite

197,159
92
443
809

Thanks! Will try. Would upvote but don't have enough reputation :( – Kid_A Jun 15 '12 at 13:36

score 0 · Answer 3 · answered Jun 15 '12 at 13:17

0

http://www.cgsecurity.org/wiki/TestDisk is your friend

answered Jun 15 '12 at 13:17

GioMac

4,544
4
27
41

Well am using that. Problem is, the file names are not preserved... – Kid_A Jun 15 '12 at 13:30

Recovering data from a damaged disk

3 Answers3