Ubuntu

How to undelete a single file that has a bad sector

Asked by JustinWalt

How can I recover a deleted file that has a bad sector? I've done loads of deleted file recoveries in my time and loads of file with bad clusters before but never have I had to deal with both at the same time.

The file is a Windows 7 desktop VM vhd on a Hyper-V 2008 R2 server and the bad sector doesn't appear to have mangled anything important but the automatic backup failed (probably due to the bad sector) so the last working backup we have is pretty old. The file would not copy due to cyclic redundancy errors (even xcopy /c wouldn't work) and my incredibly ill thought out backup batch routine managed to delete the original (note to self: always expect the unexpected). Of course I shut down the system immediately after I realised what had happened.

Anyway, how do I go about recovering this single file?
Are there any undelete programs out there that can do 'in situ undeletes' rather than 'recoveries'? I'm just worried any recovery utilities that rely on copying data elsewhere will also fall foul of that Cyclic redundancy error.

Or am I just going to have to wait until I get a second drive and do a sector by sector clone of the drive and hope the recovery works from there? Will this even work?

Any other ideas?

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Solved by:
OliverKell
Solved:
Last query:
Last reply:
Revision history for this message
actionparsnip (andrew-woodhead666) said : 		#1

Could try scalpel or foremost. You will need a writable partition of the same size or greater as the file system you are recovering from. You will lose file name and location data but you may get the file.

Alternatively just use your backups. Much quicker and easier.

Revision history for this message
Best OliverKell (oliverkell) said : 		#2

Use Recovery Toolbox File Undelete Free is an efficient recovery tool for the NTFS file system. For more: https://recoverytoolbox.com/undelete.html

Revision history for this message
Manfred Hampl (m-hampl) said : 		#3

If this is a Windows 7 desktop, why do you ask such question in the Ubuntu support area?

This whole question and answer very much looks like fake to me, just for the purpose of promoting some Windows tools.

Revision history for this message
JustinWalt (justinwalt) said : 		#4

Thanks OliverKell, that solved my question.