Lost all files due to linux installation.

[thekardinals]

I don't have anywhere to clone it to unfortunately. I only have around 10 DVD-r disks but that would only do ~44GB.

I changed mode to hex and went goto offset and export to file so:
207 980 544

Code:

LBA:207980544          block: 207 980 544
18cb100000: 59 13 A9 11 20 02 22 59  F2 36 A6 7A 57 26 26 7B  Y.©. ."Yò6¦zW&&{
18cb100010: 17 21 D3 F0 AE EF 1D 44  A6 93 02 04 26 59 1E 0D  .!Óð®ï.D¦“..&Y..
18cb100020: C5 8E DF 31 05 D4 96 A9  2C 1C 52 2E E1 5B C3 3C  ÅŽß1.Ô–©,.R.á[Ã<
18cb100030: 9A 40 A6 6B 1E 09 DF 8E  D5 E9 35 24 6F 8E 85 29  š@¦k. ߎÕé5$oŽ…)
18cb100040: A2 7E BF 65 69 A8 1E 9A  69 06 92 1F 64 E5 AB 87  ¢~¿ei¨.ši.’.d嫇
18cb100050: 48 F3 68 BD 6E 9C C9 B9  80 86 BC 51 76 63 AF 97  Hóh½nœÉ¹€†¼Qvc¯—
18cb100060: F0 71 56 76 50 27 C4 7A  96 73 B9 FF BF F4 DE 48  ðqVvP'Äz–s¹ÿ¿ôÞH
18cb100070: CE 21 F3 88 9F EB 50 5C  2C 1D 8A F8 E9 2F 12 EA  Î!óˆŸëP\,.Šøé/.ê
18cb100080: 73 B5 8E 3E 79 F9 0B DB  BE 94 66 B5 BB C9 AB 4A  sµŽ>yù.Û¾”fµ»É«J
18cb100090: 9A 29 33 2E A4 C8 76 2A  B5 1D 80 02 BF A6 40 5B  š)3.¤Èv*µ.€.¿¦@[
18cb1000a0: 5E 31 29 2E EB 5B 41 27  AD 4C 2A B7 CE 6F FE 95  ^1).ë[A'­L*·Îoþ•
18cb1000b0: EA 81 A6 C7 07 A9 AD 24  5D FE A1 20 5A 0A CF 6A  ꁦÇ.©­$]þ¡ Z.Ïj
18cb1000c0: DD 8A 4E 62 1C 3E 79 44  6D 36 62 7C 03 84 78 0E  ÝŠNb.>yDm6b|.„x.
18cb1000d0: 3B 5A 30 D1 48 6F 4B C5  39 CA CC 10 B2 C0 79 63  ;Z0ÑHoKÅ9ÊÌ.²Àyc
18cb1000e0: 54 72 23 D1 9C 4B 15 05  09 7D 2D 9E 69 63 EF EF  Tr#ÑœK.. }-žicïï
18cb1000f0: 1D 56 60 80 80 2E 30 E9  F9 93 03 9F CE 36 EB ED  .V`€€.0éù“.ŸÎ6ëí
18cb100100: 97 72 0B 90 CE 37 4C A3  8F 9F 82 C4 80 8A 7E 22  —r.Î7L£Ÿ‚Ä€Š~"
18cb100110: 45 66 21 BB D2 92 3F 50  5A 56 03 4A 53 1A 16 6D  Ef!»Ò’?PZV.JS..m
18cb100120: E5 B9 C8 C7 BE 9B E8 DE  94 90 08 47 EE 28 30 7A  å¹ÈǾ›èÞ”.Gî(0z
18cb100130: F6 DD 7B 49 E0 46 AB 65  89 34 7E 25 42 42 23 66  öÝ{IàF«e‰4~%BB#f
18cb100140: 88 4C F9 1C 90 73 23 B6  24 7C 1D 57 82 34 A8 A1  ˆLù.s#¶$|.W‚4¨¡
18cb100150: 5E DE D4 D4 33 1A 44 C3  47 BE 5B 34 B5 B0 D3 74  ^ÞÔÔ3.DÃG¾[4µ°Ót
18cb100160: D9 50 BD 06 10 7D B8 70  3D 03 4F E1 81 4A F6 6B  ÙP½..}¸p=.OáJök
18cb100170: 1A 62 81 18 8D 4F 02 96  E8 EC BC 27 4D C1 B1 E5  .b.O.–èì¼'MÁ±å
18cb100180: 6F 59 68 A5 DE F9 F6 12  30 4F 2F 82 4E CF 6C EE  oYh¥Þùö.0O/‚NÏlî
18cb100190: DE 55 13 93 F7 91 1D DA  E6 8B 15 F0 7E DC F2 9E  ÞU.“÷‘.Úæ‹.ð~Üòž
18cb1001a0: 3D 80 E7 9C 5D BF 51 A6  F4 86 31 3F 24 C9 E7 40  =€çœ]¿Q¦ô†1?$Éç@
18cb1001b0: 7B 66 B4 57 27 8A 50 54  C2 D5 FE 80 3F EE A3 94  {f´W'ŠPTÂÕþ€?
18cb1001c0: BE FE 09 6B A7 A7 9C 7F  3E 6C 07 55 35 8B AA 81  ¾þ k§§œ>l.U5‹ª
18cb1001d0: 89 66 5B 51 27 BE 3A 96  75 C0 5A 6D 19 24 C9 25  ‰f[Q'¾:–uÀZm.$É%
18cb1001e0: 62 75 3A 04 6F 7A 4A 1C  3B 29 9F C7 AC 09 6E E0  bu:.ozJ.;)ŸÇ¬ nà
18cb1001f0: 4C 5C AA 92 6C FB D8 72  41 2A 8D 42 FF D8 D0 61  L\ª’lûØrA*BÿØÐa


768587855

Code:

LBA:768587855          block: 768 587 855
5b9f709e00: B8 5F 27 11 86 FB 75 12  61 B8 5F 27 11 86 FB 75  ¸_'.†ûu.a¸_'.†ûu
5b9f709e10: 12 61 B8 5F 25 11 4F C3  E4 29 21 3C 0D 93 F4 18  .a¸_%.OÃä)!<.“ô.
5b9f709e20: 0D 9E 86 C9 5F 74 C0 D3  30 FD CE 5E A0 F2 E4 05  .ž†É_tÀÓ0ýÎ^ òä.
5b9f709e30: 2A CF 5E A0 F2 C5 0B 54  5E BC 40 E5 AB 17 A8 5C  *Ï^ òÅ.T^¼@å«.¨\
5b9f709e40: 81 C3 D3 30 C9 CD D1 E0  69 98 E4 E6 68 F0 34 4C  ÃÓ0ÉÍÑài˜äæhð4L
5b9f709e50: BF 0F 2F 50 F9 AF 17 A8  FC E9 05 2A 7F 79 81 CA  ¿./Pù¯.¨üé.*yÊ
5b9f709e60: FF BC 10 95 3F 3F BD 10  95 3F BF BC 10 95 FB B3  ÿ¼.•??½.•?¿¼.•û³
5b9f709e70: 18 78 1A A6 E7 8F 17 A2  F2 E7 C5 0B 51 F9 D3 F1  .x.¦ç.¢òçÅ.QùÓñ
5b9f709e80: 81 E1 9E 8E 0F 0C F7 74  7C 60 B8 A7 E3 03 C3 F9  ážŽ..÷t|`¸§ã.Ãù
5b9f709e90: 63 1D 78 1A A6 A7 E3 03  C3 3D 1D 1F 18 EE E9 F8  c.x.¦§ã.Ã=...îéø
5b9f709ea0: C0 70 4F C7 07 86 7B DE  BD 40 E5 CE 15 0C F7 74  ÀpOÇ.†{Þ½@åÎ..÷t
5b9f709eb0: AE 60 B8 A7 73 05 C3 3D  9D 2B 18 EE E9 5C C1 70  ®`¸§s.Ã=+.îé\Áp
5b9f709ec0: 4F E7 0A 86 7B 3A 57 30  DC D3 B9 82 E1 9E CE 15  Oç.†{:W0ÜÓ¹‚ážÎ.
5b9f709ed0: 0C E7 69 40 3C 0D D3 CB  B9 82 E1 5E CE 15 0C F7  .çi@<.Ó˹‚á^Î..÷
5b9f709ee0: 72 AE 60 38 0F 16 E2 69  98 5E 0E 1C 0C 27 7D 4C  r®`8..âi˜^...'}L
5b9f709ef0: 83 A7 61 7A 39 89 30 DC  CB 49 84 E1 5E 4E 22 0C  ƒ§az9‰0ÜËI„á^N".
5b9f709f00: F7 72 12 61 B8 97 93 08  C3 BD 9C 44 18 EE E5 24  ÷r.a¸—“.ýœD.îå$
5b9f709f10: C2 70 FE 9E 0C 9E 86 E9  E5 24 C2 70 2F 27 11 86  Âpþž.ž†éå$Âp/'.†
5b9f709f20: 7B 39 89 30 DC CB 49 84  E1 5E 4E 22 0C F7 72 12  {9‰0ÜËI„á^N".÷r.
5b9f709f30: 61 B8 97 93 08 C3 BD 9C  44 18 CE DF C5 C1 D3 30  a¸—“.ýœD.ÎßÅÁÓ0
5b9f709f40: 79 66 14 4F C3 F4 72 12  61 B8 3F 27 11 86 FB 73  yf.OÃôr.a¸?'.†ûs
5b9f709f50: 12 61 B8 3F 27 11 86 FB  73 12 61 B8 3F 27 11 86  .a¸?'.†ûs.a¸?'.†
5b9f709f60: FB 73 12 61 B8 3F 27 11  86 FB 73 E0 60 B8 3F 07  ûs.a¸?'.†ûsà`¸?.
5b9f709f70: 0E 86 FB 73 E0 60 B8 3F  07 0E 86 FB 73 E0 60 B8  .†ûsà`¸?..†ûsà`¸
5b9f709f80: 3F 07 0E 86 FB 73 E0 60  B8 3F 07 0E 86 FB 73 E0  ?..†ûsà`¸?..†ûsà
5b9f709f90: 60 38 7F C0 08 4F C3 F4  E7 C0 C1 70 7F 0E 1C 0C  `8À.OÃôçÀÁp...
5b9f709fa0: F7 E7 C0 C1 70 7F 0E 1C  0C F7 E7 C0 C1 70 7F 0E  ÷çÀÁp...÷çÀÁp.
5b9f709fb0: 1C 0C F7 E7 C0 C1 70 FE  DE 12 9E 86 D9 DF 5B C2  ..÷çÀÁpþÞ.ž†Ùß[Â
5b9f709fc0: D3 30 FB 7B 4B 78 1A 66  7F 6F 09 4F C3 EC 79 67  Ó0û{Kx.fo OÃìyg
5b9f709fd0: 3C 0D B3 E7 9D F1 34 CC  9E 77 C6 D3 30 7B AC 19  <.³çñ4ÌžwÆÓ0{¬.
5b9f709fe0: 4F C3 EC B1 66 3C 0D B3  C7 9A F1 34 CC FE DE 12  OÃì±f<.³Çšñ4ÌþÞ.
5b9f709ff0: 9E 86 D9 9F 55 C2 D3 30  7B DE 19 4F C3 EC 79 67  ž†ÙŸUÂÓ0{Þ.OÃìyg


63

Code:

LBA:63                 block: 63
0000007e00: 1E D0 E0 0B A1 71 05 29  7A 4E E5 07 28 FE 9E D5  .Ðà.¡q.)zNå.(þžÕ
0000007e10: AD D1 ED 9D 3E 53 61 7F  9D F5 CA 72 BE 4E 94 72  ­Ñí>SaõÊr¾N”r
0000007e20: A6 1C 9E BD 15 37 E1 0B  17 E5 27 4F D0 2D 6D 9B  ¦.ž½.7á..å'OÐ-m›
0000007e30: B6 79 0E D8 F8 05 2D 7D  B2 A8 AD 91 61 0D 14 9D  ¶y.Øø.-}²¨­‘a..
0000007e40: 27 8F E1 97 E0 B4 66 68  4C C1 9B FC D8 C9 71 77  'á—à´fhLÁ›üØÉqw
0000007e50: 7E 1A 3A F0 4E 08 D4 FB  09 BD 6D 0B 7E B7 C8 1B  ~.:ðN.Ôû ½m.~·È.
0000007e60: DC DA 3D 9B 7A 1A 18 BD  8C 2F 8C E3 8F D1 81 BA  ÜÚ=›z..½Œ/ŒãÑº
0000007e70: B0 8B 30 E5 D8 52 03 9C  37 45 BE 12 8F E5 FD AD  °‹0åØR.œ7E¾.åý­
0000007e80: F5 62 D2 DF 75 DE 02 01  69 27 EA 38 AF E5 DD 10  õbÒßuÞ..i'ê8¯åÝ.
0000007e90: CC 7A 53 55 71 97 F3 A7  81 D2 F6 D6 EA E0 DA 1C  ÌzSUq—ó§ÒöÖêàÚ.
0000007ea0: BB 6F D8 53 9D F5 39 C5  20 D7 12 BD A0 3A B1 B8  »oØSõ9Å ×.½ :±¸
0000007eb0: AC E2 81 CA B2 05 2F 0D  D0 47 DB 5F 2B 70 1E 3C  ¬âÊ²./.ÐGÛ_+p.<
0000007ec0: 1F 76 78 E1 98 7D 67 9E  9B C1 08 CC FD 7B 09 F7  .vxá˜}gž›Á.Ìý{ ÷
0000007ed0: AD 23 8F 5A EA 0E 06 48  B9 29 BD B4 CE 5B 8B 19  ­#Zê..H¹)½´Î[‹.
0000007ee0: F9 83 5C BA AF 26 BA 8E  9F 0E 30 C5 CB 86 85 4C  ùƒ\º¯&ºŽŸ.0ň…L
0000007ef0: BD 7F 43 8F E8 84 23 5B  4B 93 4A 80 02 78 69 EF  ½Cè„#[K“J€.xiï
0000007f00: 6C C4 73 EE 98 FE 89 D3  91 C8 EF 59 CD 25 56 DD  lÄsî˜þ‰Ó‘ÈïYÍ%VÝ
0000007f10: 69 C6 9B CE 1B 74 F5 60  5C C3 7B 89 3E BA 91 24  iÆ›Î.tõ`\Ã{‰>º‘$
0000007f20: E6 D4 8B 18 0C 1A 13 6B  9C F3 7D 94 49 D4 B0 5A  æÔ‹....kœó}”IÔ°Z
0000007f30: 13 A2 BC 19 70 01 E2 18  F9 90 AB 57 F2 AD B1 FB  .¢¼.p.â.ù«Wò­±û
0000007f40: 3A 78 36 36 DD 21 26 D4  A6 0C 58 AF FF E7 DE 91  :x66Ý!&Ô¦.X¯ÿçÞ‘
0000007f50: 19 43 90 DC 9A 3B 96 EC  D2 DB 7E D5 79 17 B3 D0  .CÜš;–ìÒÛ~Õy.³Ð
0000007f60: F7 DE E7 0F 2B 2E 22 E5  0A E9 7F 55 F6 9E 94 12  ÷Þç.+."å.éUöž”.
0000007f70: E0 11 17 D7 0C 21 E7 5A  19 E1 D3 E6 E4 32 C1 56  à..×.!çZ.áÓæä2ÁV
0000007f80: D8 68 80 C7 6C 1C A2 63  B2 6A C7 A6 5D C4 54 3D  Øh€Çl.¢c²jǦ]ÄT=
0000007f90: E5 CD 51 4D 4B CE 44 75  F8 9B 26 4F BB E6 EA 2B  åÍQMKÎDuø›&O»æê+
0000007fa0: 37 F4 7C 83 51 C3 87 A7  F7 92 18 69 87 C4 EC C3  7ô|ƒQǧ÷’.i‡ÄìÃ
0000007fb0: D7 99 78 14 35 A6 9E 32  EF AD C7 03 DA D0 83 D8  ×™x.5¦ž2ï­Ç.ÚЃØ
0000007fc0: 9D FA 98 5A B3 31 CE E3  62 44 4B AF F0 61 62 85  ú˜Z³1ÎãbDK¯ðab…
0000007fd0: 26 7D C5 42 53 B8 B9 85  74 B3 A1 9D 41 A9 EB F9  &}ÅBS¸¹…t³¡A©ëù
0000007fe0: 31 51 51 59 E7 FE C7 04  C3 AE F2 EE 02 57 E5 3F  1QQYçþÇ.îòî.Wå?
0000007ff0: D9 05 8C 55 81 78 5D E3  41 57 3C FD 00 63 F7 E1  Ù.ŒUx]ãAW<ý.c÷á


Just a question: how many people here do manage to recover their data?
Another one: can't I just reformat the drive as NTFS (as a last resort if not now) and try recuva on it or easeus?

[labtech]

Formatting is a write operation to the drive. Meaning, more overwriting over what is already there (or lost). To recover files, there is NEVER a need to re-format a drive. It is a simple misnomer that things may be better, when they actually won't.

[thekardinals]

Aha ok. I thought I should do it because I have nowhere else to move (if I find it) all the ~350GB I lost except that hard drive. I'm gonna have to buy another HDD or I can write somehow back to it (which seems impossible to recover and write to it at the same time)?

[labtech]

Maybe you can borrow another drive. Or think of is as an investment: buy one and then wipe and then sell it. It is a good idea to have another drive for backups anyway.

[thekardinals]

Yes it is a good idea. This one has a bad sector either way but I could give it to my sister in an HDD enclosure as an external drive but getting a good value for money in my small town is very hard so it's gonna take some time. They are usually those WD caviar green which are cheap but bad.

Do you have any other idea what I should do now besides cloning the drive?

[fzabkar]

AISI, it's looking like the only option might be a raw recovery in which case DMDE should be able to handle it. Also, PhotoRec is a popular freeware tool.

[thekardinals]

How do I do it? Just full scan first for raw and then recover or?

[fzabkar]

A raw scan searches for files based on "signatures".

For example, a JPEG file might have a header such as ...

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  FF D8 FF E0 00 10 4A 46 49 46 00 01 01 01 04 B0  ÿØÿà..JFIF.....°

The file ends with FF D9.

One of the limitations of a raw scan is where the file is fragmented. Another is where parts of it have been overwritten. Still a third problem is that the name of the file will probably be lost.

After Using PhotoRec (Some ideas to sort recovered files or repair broken ones):
http://www.cgsecurity.org/wiki/After_Using_PhotoRec

[thekardinals]

I'm already getting some results 7% into the search but that doesn't mean those files are good, correct? They could be damaged.

[fzabkar]

I'm already getting some results 7% into the search but that doesn't mean those files are good, correct? They could be damaged.

Yes and yes. You should really have a sector by sector clone. This will enable you to safely run several tools against your data.

[thekardinals]

Thing is like I said it's hard to find a drive worth spending the money in my region and I will need to buy one if I wanted to clone it all. I sent a mail to a company and if I get a respond I'm going out and buying one.

At this point I'm even accepting that I probably lost it all. I just wish I could at least get a list of all my files if not files themselves. I don't even remember all the stuff that I lost but I'm going to need them at one point.

[thekardinals]

Is recovering a "writing" operation to the disk if I recover it to another disk?

[thekardinals]

Also found this http://www.sysdevlabs.com/product.php?id=ufsxs5 software. Anyone had experience with it?

[scratchy]

This is why I prefer WinHex, I can search volume for NTFS file system components. If I could find $MFT record I could probably rebuild boot sector manually. At least to a condition where DR software would recognise it as an NTFS partition.

By all means try UFS, it is pretty good at rebuilding FS structures. But take note of making a clone of the HDD.. as mentioned by others above.

[thekardinals]

I just got a reply saying this company has only WDs unfortunately.

How do I do that NTFS file system components search in winhex?

[drHDD]

if you can provide remote access - I can look and tell if there is chance to recover files or not.

[thekardinals]

Teamviewer good?

[fzabkar]

This is why I prefer WinHex, I can search volume for NTFS file system components. If I could find $MFT record I could probably rebuild boot sector manually. At least to a condition where DR software would recognise it as an NTFS partition.

DMDE's "NTFS search" will find all NTFS components including MFT and INDX records, if they exist. In fact the OP's search results display a count of the numbers of such records.

Tools -> Search for Special Sector will find particular file system components.

Attachments

[fzabkar]

Is recovering a "writing" operation to the disk if I recover it to another disk?

"Recovering" writes the recovered data to another drive, not the patient.

[thekardinals]

Under special sectors which ones should I select? Only MFT and INDX or I need more?