Problem saving currupted data from one exHD to another using Photorec

Asked by Ricardo Diamondo

I have a 500GB external HD that has been corrupted (thanks to an Android device that tried to re-format it). Using Photorec through Testdisk in Terminal, I find that although I can locate the corrupted drive by a number now (2286-1507), I cannot locate the other external HD (2TB). All I get as options are locations on my Laptop HD.
Please can you tell me the step by step code for saving the data to the 2TB exHD drive?
I am a pensioner who has only used Ubuntu Linux for a few years and am not clear about the Terminal side of things so please make the directions as simple as possible. Thanks.
Last time I tried all I got for the saving options were:
PhotoRec 7.0, Data Recovery Utility, April 2015

Please select a destination to save the recovered files.
Do not choose to write the files to the same partition they were stored on.
Keys: Arrow keys to select another directory
      C when the destination is correct
      Q to quit
Directory /home/siddartha
siddartha@siddartha-Lenovo-G575:~$ 9-May-2017 20:57 .
 drwxr-xr-x 0 0 4096 23-Aug-2015 01:20 ..
 drwxr-xr-x 1000 1000 12288 13-May-2017 13:00 Desktop
 drwxr-xr-x 1000 1000 4096 17-Apr-2017 10:56 Documents
 drwxr-xr-x 1000 1000 4096 24-Apr-2017 12:22 Downloads
 drwxr-xr-x 1000 1000 4096 10-May-2017 11:37 Music
 drwxrwxr-x 1000 1000 4096 19-Jul-2015 11:54 My PhotoFilmStrips
 drwxr-xr-x 1000 1000 12288 9-May-2017 11:37 Pictures
 drwxr-xr-x 1000 1000 4096 10-May-2015 22:32 Public
 drwxrwxr-x 1000 1000 4096 7-Oct-2015 16:02 Solar Impulse
 drwxr-xr-x 1000 1000 4096 10-May-2015 22:32 Templates
 drwxr-xr-x 1000 1000 4096 10-May-2017 11:04 Videos
 drwxrwxr-x 1000 1000 4096 18-Jul-2016 12:25 avidemux2
 drwxr-xr-x 1000 1000 4096 11-May-2015 00:48 fontconfig
 drwxrwxrwx 1000 1000 4096 28-Oct-2016 21:58 livestmp

Plus some other options, but all on my laptop!

Question information

Language:
English Edit question
Status:
Expired
For:
Ubuntu testdisk Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
actionparsnip (andrew-woodhead666) said :
#1

What is the output of:

sudo fdisk -l

Thanks

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#2

Thanks for getting back to me.
After entering sudo fdisk -l (with both external HD's connected), I got the following:

siddartha@siddartha-Lenovo-G575:~$ sudo fdisk -l
[sudo] password for siddartha:
Disk /dev/sda: 298.1 GiB, 320072933376 bytes, 625142448 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: dos
Disk identifier: 0x000a8541

Device Boot Start End Sectors Size Id Type
/dev/sda1 * 2048 617582591 617580544 294.5G 83 Linux
/dev/sda2 617584638 625141759 7557122 3.6G 5 Extended
/dev/sda5 617584640 625141759 7557120 3.6G 82 Linux swap / Solaris

Partition 2 does not start on physical sector boundary. (this line is in red!)

Disk /dev/sdb: 465.8 GiB, 500107859968 bytes, 976773164 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xda1b8a5e

Device Boot Start End Sectors Size Id Type
/dev/sdb1 * 2048 976773163 976771116 465.8G c W95 FAT32 (LBA)

Disk /dev/sdc: 1.8 TiB, 2000398931968 bytes, 3907029164 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xa8f842a0

Device Boot Start End Sectors Size Id Type
/dev/sdc1 206848 3907024064 3906817217 1.8T 7 HPFS/NTFS/exFAT
siddartha@siddartha-Lenovo-G575:~$

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#3

OK, we can see a 2Tb partition as /dev/sdc1

If you grab another 2Tb drive then you can use foremost to attempt to recover data from it. You will lose filename information and location but you may get partial or full files back. If a file has had part of its information written over with new data then it is gone.

Is there no backup of the data? Restoring the data will ensure the data is pristine and definitely restorable.

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#4

Thanks.
It is the 500GB drive (showing above as 465.8 GiB) that I am attempting to save to the 2TB drive.
But the 2TB drive does not show up on the destination options when I tried to recover the data.
(You have recently resolved my problem of it clogging up my laptop hard drive when I tied before, but now it seems to want to save onto my laptop again!)
Please can you tell me the code to save it to the 2TB (USB drive) rather than my laptop?
Please bear in mind that I am a novice regarding these things...

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#5

sudo apt-get install foremost; clear

Then what is the output of:

mount

Thanks

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#6

Do I enter the "sudo apt-get install foremost; clear" at the point when Photorec gives the options for a save destination?
The output is mp3's & avi's,
Please excuse my ignorance.

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#7

The command I gave to install foremost is just that. The clear command is to remove confusion. We need the output of the command to see the folder we need to output the found data to.

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#8

After installing 'foremost' all I got was the following:

Some text missing from Terminal then:

  ogmtools paps python-poppler python-pypdf python3-brlapi python3-louis
  python3-pyatspi python3-speechd qstat qtdeclarative5-accounts-plugin
  rtmpdump scummvm-data snap-confine synfig-examples ubuntu-core-launcher
  unity-webapps-qml whoopsie-preferences youtube-dl
Use 'sudo apt autoremove' to remove them.
The following NEW packages will be installed
  foremost
0 to upgrade, 1 to newly install, 0 to remove and 8 not to upgrade.
Need to get 42.6 kB of archives.
After this operation, 138 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu xenial/universe i386 foremost i386 1.5.7-6 [42.6 kB]
Fetched 42.6 kB in 0s (281 kB/s)
N: Ignoring file 'getdeb.list.bck' in directory '/etc/apt/sources.list.d/' as it has an invalid filename extension
Selecting previously unselected package foremost.
(Reading database ... 1448492 files and directories currently installed.)
Preparing to unpack .../foremost_1.5.7-6_i386.deb ...
Unpacking foremost (1.5.7-6) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up foremost (1.5.7-6) ...
N: Ignoring file 'getdeb.list.bck' in directory '/etc/apt/sources.list.d/' as it has an invalid filename extension

siddartha@siddartha-Lenovo-G575:~$

I'm not sure now about what 'mount' notice to post....

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#9

Then run:

sudo rm /etc/apt/sources.list.d/getdeb.list.bck

It will remove the warning.

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#10

Run:

mount

What is the output please?

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#11

Sorry for delay - had to go to Doctors.

siddartha@siddartha-Lenovo-G575:~$ mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=1843544k,nr_inodes=205153,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=372444k,mode=755)
/dev/sda1 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /sys/fs/cgroup type tmpfs (rw,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,clone_children)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event,release_agent=/run/cgmanager/agents/cgm-release-agent.perf_event)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb,release_agent=/run/cgmanager/agents/cgm-release-agent.hugetlb)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids,release_agent=/run/cgmanager/agents/cgm-release-agent.pids)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=23,pgrp=1,timeout=0,minproto=5,maxproto=5,direct)
mqueue on /dev/mqueue type mqueue (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime)
cgmfs on /run/cgmanager/fs type tmpfs (rw,relatime,size=100k,mode=755)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=372444k,mode=700,uid=1000,gid=1000)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
/dev/sdb1 on /media/siddartha/2286-1507 type vfat (ro,nosuid,nodev,relatime,uid=1000,gid=1000,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,showexec,utf8,flush,errors=remount-ro,uhelper=udisks2)
/dev/sdc1 on /media/siddartha/TOSHIBA EXT type fuseblk (rw,nosuid,nodev,relatime,user_id=0,group_id=0,default_permissions,allow_other,blksize=4096,uhelper=udisks2)
siddartha@siddartha-Lenovo-G575:~$

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#12

OK, we'll use:
 /media/siddartha/TOSHIBA

As the output folder. This is the mount point of the 2Tb partition. You should run:

sudo umount /dev/sdb1

To unmount it.

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#13

You can then run the below 2 commands:

mkdir /media/siddartha/TOSHIBA/recovery

sudo foremost -i /dev/sdb -o /media/siddartha/TOSHIBA/recovery

This will work through the drive and attempt to recover data. It will take a while but let it bake. You can see files in the recovery folder.

When the prompt comes back under the foremost command then it is done

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#14

Hi,
I have been running your suggested foremost recovery for over 40hrs now.
Something seems to be happening to the Toshiba drive so I guess it is working.
I know that you said it would take a while, but....
Is this usual for a recovery of about 400GB of data? (approx. 10GB per hour - so far)

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#15

Let it bake. A good backup regime completely removes the need for any of this.....

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#16

Thanks. I'll keep it in the oven.
The external HD that was corrupted (by an Android device trying to re-format it) was a back-up of extensive data too large to keep on my lap-top. But after this incident I will keep a double back-up, thanks.

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#17

Well, after 125 continuous hours it has finally finished baking.

The Toshiba external hard drive, that I hoped to recover the data onto, is still empty of the recovered data.

However.....there is a TOSHIBA folder now on my laptop under siddartha, which contains:

4 Binary (application/octet stream) files: named - exe, gif, pdf & png
Plus one audit.txt file

All these files are admin-only accessible.

My worry now, after such a long time, is that the external hard drive, which I was trying to recover the data from, only contained mp3 and avi files, so I am not sure that the job has been done (and, if it has, then it is not accessible).

Revision history for this message
actionparsnip (andrew-woodhead666) said :
#18

If you use the chown command, you can make your user the owner of the data. Root made the data so it is therefore root owned.

If you can give the full path of the data, I can give a command.

The files in the folder are the ones recovered by foremost. Each folder name is the 3 character extension of the files in the folder.

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#19

Please excuse my pensioner ignorance, but I do not know the full path of the data, nor how to find it (siddhartha/TOSHIBA?).

I am still worried that the mp3 & avi files (the only files that existed on the corrupted HD) are not showing up on the outcome of running foremost.

Is it worth continuing along the exe, gif, pdf & png route, as I'm not convinced that they originate from the corrupted HD?

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#20

I think the full path may be: media/siddhartha/TOSHIBA

Revision history for this message
Launchpad Janitor (janitor) said :
#21

This question was expired because it remained in the 'Open' state without activity for the last 15 days.

Revision history for this message
Ricardo Diamondo (dick-diamond2000) said :
#22

I would still like help in recovering the data from a corrupted 500GB External Hard Drive to another 2TB External Hard Drive if anyone knows how this can be done?

But please bear in mind my ignorance of using the Terminal, so I need clear commands to copy & paste.

Any help would be greatly appreciated.

Revision history for this message
Launchpad Janitor (janitor) said :
#23

This question was expired because it remained in the 'Open' state without activity for the last 15 days.