Please Help with Lacie data recovery-software possibly?

[milescortez]

I've checked the "Best Software" Thread and the info is not in there. Maybe it's more of a general question.

I deleted some shares on a 1TB LAcie Ethernet BD. The data is all there (I can see it using a variety of softwares to scan teh image file I created) but I am looking to recover the folder structure and file names. Do I want to do a "repair volume"? Repair Partition? Recover deleted files?

Everything I see shows renamed files such as 3145262.doc. I can open the document and it's perfect but I'd have to go through tens of thousands of documents, mpegs, xls files etc. and rename them. Hardly practical. i really need to what process to use to recover the folder structure and file names.

Separately, there are a bunch of iphone text message files that I need for legal reasons. They are *.mddata and *.mdinfo extensions and are organized by their own folder structure.

I am guessing someone know how to do this or what software to use. It should be an easy fix I think. I just need the right tools. There is nothing physically wrong with the drive. When I created a new "testshare" I can see it fine. The disk operates perfectly as it did before, it just shows up as 900+GB free when there was 700+GB of data on it.

I have access to linux, mac and windows so I can use any tool. I've checked r-studio, ddrescue, photorec, recovermyfiles along with a handful of others.

I have an image file and the actual disk shows up as a network drive. The drive itself consists of 2 500GB drives that are spanned. In UBUNTU terminal I've assemble the two drives and can scan them as one using DDrescue.

Can someone please PLEASE help. It's so frustrating because I know the info is there....I just need it back. I'm wondering if I'm making it more complicated than it needs to be.

[harddrivespecialist]

Before you loose your data completely, you should make an image of those drives and then work with an image to avoid any possible data loss.

[milescortez]

Before you loose your data completely, you should make an image of those drives and then work with an image to avoid any possible data loss.

I've already done that using DD rescue but I've noticed that some of the windows software cant recognize that image. Any free software out there that I can use to create a new image. I assume *.img format is what I want.

[Nick_CT]

Windows software called Mount Image Pro (http://www.mountimage.com) can mount the .img file you made with dd_rescue. Then you can run your recovery software on the mounted image. Not sure about the limitations on the trial version though, the full version works well for me.

[lcoughey]

Did you make a dd image of each physical drive in the raid array or an image of the mounted volume via the network? As the file system is not NTFS or FAT, you are unlikely to recover the original file names. But, at the very least, you'll need to use a program that can work with XFS in order to properly reconstruct the file structure. However, as I alluded to, Linux file systems aren't designed with undelete in mind as it is assumed that users will backup their data. So, you aren't very likely to get much more than what you have.

Good luck!

[milescortez]

Did you make a dd image of each physical drive in the raid array or an image of the mounted volume via the network? As the file system is not NTFS or FAT, you are unlikely to recover the original file names. But, at the very least, you'll need to use a program that can work with XFS in order to properly reconstruct the file structure. However, as I alluded to, Linux file systems aren't designed with undelete in mind as it is assumed that users will backup their data. So, you aren't very likely to get much more than what you have.

Good luck!

I made an image of the combined drive with all the various partitions linux based and otherwise. The data partition is NTFS I believe. I can make an image of the individual drives if necessary. It's recognized as a NTFS disk by some of the windows data recovery software I've played with. What about UFS Explorer of UFS Explorer Pro?

[lcoughey]

I made an image of the combined drive with all the various partitions linux based and otherwise. The data partition is NTFS I believe. I can make an image of the individual drives if necessary. It's recognized as a NTFS disk by some of the windows data recovery software I've played with. What about UFS Explorer of UFS Explorer Pro?

Your drive would be the first LaCie network drive for me to see as NTFS. It is almost always XFS. UFS explorer certainly works with XFS, but it is still unlikely that you will gain access to the deleted data in the original file name and folder structure.

[milescortez]

I made an image of the combined drive with all the various partitions linux based and otherwise. The data partition is NTFS I believe. I can make an image of the individual drives if necessary. It's recognized as a NTFS disk by some of the windows data recovery software I've played with. What about UFS Explorer of UFS Explorer Pro?

Your drive would be the first LaCie network drive for me to see as NTFS. It is almost always XFS. UFS explorer certainly works with XFS, but it is still unlikely that you will gain access to the deleted data in the original file name and folder structure.

Yes you are right it's an XFS file. What are the chances of me recovering the share(s). i tried to reset them up with the original share name to no avail. Any idea what happened here? Did I corrupt one of the file partitions by deleting the share? What about if I try to repair the bad partition? Would it be helpful if I posted the scan information from testdisk in Linux?

[lcoughey]

If your data is important to you, seek a professional before it is too late. If it isn't, you'll have to run as many data recovery programs you can think of against the clone, assuming that your clone is adequate for the job. But, as I said, you are unlikely to get anything more than a RAW recovery...but, you might get lucky if you find the right tool for the job.

[milescortez]

If your data is important to you, seek a professional before it is too late. If it isn't, you'll have to run as many data recovery programs you can think of against the clone, assuming that your clone is adequate for the job. But, as I said, you are unlikely to get anything more than a RAW recovery...but, you might get lucky if you find the right tool for the job.

I guess let's start here: What's the best way to create a new image that I can mount and thus have the most recovery options to tool around with. Should I image the assembled drive or the two drives indivudally?

There are a lot that won;t recognize the DD Rescue image or a drive on the network. Second question---what has the best/most tools, windows, linux or mac?

[DR-Kiev]

1) Bad news:
XFS is journaling file system. So , when you deleted one folder , you deleted journal list of all names and address inside which belonged to this folder .


2) Good news:
Most of files keeps its unique metadata inside , for example jpg keeps creation date, name of the camera, used software processing, etc.
Office documents store creation time, last using time, name of the creator, etc.

So you could write some programm which sort your RAW-mode restored files by its metadata.
We did it , and its realy helped sometimes. But it is our commercial soft.
Also you could try to find in interent soft which do this sorting, but I have not seen.


P.S. For creating images use WinHex ( clone disk).

[fzabkar]

You should be able to use your OS's Find command to search for text strings at the beginning of each file. Then copy and paste the search results to a new directory. Alternatively, you can write a batch routine that Finds and Moves each file type to a Photo or Doc directory, or any subdirectory thereof.