All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 57 posts ]  Go to page Previous  1, 2, 3
Author Message
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 15:14 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
The "NTFS Search" should have offered you the option of saving a log. Did you do this?

The log lists the found MFT fragments in gory detail. I don't claim to completely understand the output, but someone else might.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 15:26 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
I saved the log of both NTFS and raw scan. I will attach both. I'm scanning those two in the mean time.


Attachments:
File comment: NTFS scan
devscan.log [79.71 KiB]
Downloaded 537 times
File comment: Raw scan
devscanraw.log [1.18 MiB]
Downloaded 530 times
Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 15:47 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
It's already finished that MFT/INDX scan and I think it's kinda saying there's no MFT found

http://i.imgur.com/EfNKE94.png

and finding something MFT related

http://i.imgur.com/ltK2NVA.png


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 16:14 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Code:
scan_range="0x0-0x5d27216000"
scan_state_sec="block:0x2000;inc:0x4000;first:0x2000;shift:0x2000;sec:0x2e9390b0;set:0x0"
MFT_frags_number=287

The scan spans the entire 400GB range (byte offsets 0x0-0x5d27216000) and the scan state points to the last sector (0x2e9390b0), so this indicates that the entire physical drive was searched and 287 MFT fragments were found.

I have sorted these fragments by their byte offsets (see attachment).

The first MFT record is at offset 0x23e647d800, ie sector 0x11F323EC (301147116). This corresponds to around 150GB.

Code:
MFT_202=0x23e647d800:16:13:0x400:0x0:0x1000:0xffffffff:0x0:0:0:0x2

ISTM that the original file system was obliterated.


Attachments:
MFTsort.rar [3.91 KiB]
Downloaded 344 times

_________________
A backup a day keeps DR away.
Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 16:29 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
And now the translation of what should I do? :D


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 16:46 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Your log indicates that DMDE has already found all the MFT and INDX records. AFAICS, another search would be pointless.

You could try an MFT search with Winhex, but someone else would need to advise you.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 16:55 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
Ok I will wait till tomorrow night if I don't get anywhere I'm just going to format it back to NTFS, try something like recuva and what I get is what I get.

It's been too much of a hassle for me and even more for y'all.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 17:06 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Don't format your drive. You will only make things worse. DMDE's raw search should have found your files. PhotoRec should produce similar results.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 17:16 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
But see the problem is that I don't have anywhere to copy them now. Since I couldn't find a decent hard drive I don't think I can get them recovered straight to that 400GB drive (no?).


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 17:35 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
If only I could see what I'm recovering so I can burn some stuff onto DVDs because I intended to do so even before I lost it all.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 17:45 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
At least recover one or two files to a flash drive.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 18:01 
Offline

Joined: October 5th, 2015, 18:53
Posts: 474
Location: US
thekardinals wrote:
Teamviewer good?

Good.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 18:07 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
I can recover to one of the other hard drives. They've got plenty of space. Just don't know how much that file will take up nor how to recover them :D

P.S. actually I tried recovering from what was found by that raw search and it didn't let me because it was a free version of DMDE. Any free software without limitations?


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 18:31 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
Launch DMDE
uncheck the Show Partitions checkbox -> OK
Tools -> Full Scan -> Load -> devscanraw.log
select a particular search result, eg jpeg
double-click it or select Open Volume
expand $RAW -> Graphics -> jpeg
click the jpeg results
r-click a particular jpeg file (eg f39719466.jpeg) -> Recover the Object

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 18:42 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15440
Location: Australia
PhotoRec is freeware.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 15th, 2017, 18:47 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
Already tried that way with DMDE but it only allows 4000 files. Will try photorec tomorrow maybe on linux (because it's my main OS I always boot into it first). It's the same thing, at least it looks the same.

It's getting late now.


Top
 Profile  
 
 Post subject: Re: Lost all files due to linux installation.
PostPosted: March 19th, 2017, 11:48 
Offline

Joined: March 10th, 2017, 9:27
Posts: 28
Location: south europe
Well I recovered most of my video files but games would be too time consuming to download and rename all files as they should be. I recovered all this using photorec and it's pretty neat software for being free. You can even continue recovering after you shut down the PC so it's not all in one day.

Still I learned my lesson, backups, backups and backups.

Thanks to everyone that helped.

Solved.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 57 posts ]  Go to page Previous  1, 2, 3

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 44 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group