Ext3 data recovery

[pcimage]

Fascinating, how like the last 10 posts / posters are misinterpreting the context and going completely offtopic into something irrelevant to the OP's problem - only because of reckless reading that made them slip into a backup-tribute coma. He got 99 problems but a failing hard drive ain't one. He only wants to undelete / recover a deleted file. Therefore, he does not need to maniacally image his drive, unless he feels uncomfortable about somehow pressing the wrong set of keys - which is pretty hard to fluff up anyway, as testdisk presents you with a descriptive dialog and a warning, specifically for that exact thing (saving to a different storage). Lecturing about the importance of cloning is one thing, understanding the issue at hand and presenting a rational solution - is another. Imagine the redundancy, if he only needs to locate a single deleted file and is going to image a 2TB drive, just for that. Can speculate, that he might simultaneously have a failing hard drive, but what are the odds of that in this particular case? Pretty low. If it was really in such a bad shape - it would die regardless when being imaged or when testdisk would've had it's way with it: you either get an incomplete image or an array of recovered files. One is not much better than the other.

Also, it's not really testdisk, but photorec for the needed functionality.

So, by your reckoning, If you have a hard drive that belongs to someone else (and potentially contain irreplaceable data) you should not take the extra time to clone it, purely because it appears to be working NOW?

So hard drives never fail, right?

It's flippant attitudes like that and blatant disregard for people's data that loses people's data.

If its your own drive and YOUR data then fill your boots, bugger about with it to your hearts content, but it's not.

I really hope you don't decide to open a "data recovery" company along the other droves of clowns who want to make a quick buck.

[XXL]

I have a case where customer has deleted data from linux ext3 file system.

(emphasis mine)

When dealing with data belonging to someone who is paying you and trusting their data to you, which is more important? Absolute safety, or saving a few minutes?

There is no such thing as absolute safety. The hard drive can fail the moment it is imaged or being processed by photorec (it saves data while doing so). So, the end result is the same. Either you get an incomplete image or a bunch of files. Under certain circumstances - the first is better, under other - the latter. Therefore, it's close to being equally irrelevant.

[TaskManager]

Thanks all for sharing there thoughts.Hope everyone has got something.
I think everyone has something correct in this discussion.

1) From a Professional point of view disk must be imaged even if disk is perfectly healthy provided that
a) job is from a business / corporate customer who understands time , efforts ,technology involved in the process and is ready to pay.
b) For non critical cases where data is not so critical like home computers and depending upon case like by connecting a linux hdd to windows based pc may not write anything on it , Imaging can be ignored but by taking proper precautions only

2) In case disk is encrypted like EFS encryption where keys also needs to be recovered , Imaging is absolute must.
3)Imaging has certain advantges like if customer wants some data later successful recovery and even if original disk is not available or returned for warranty replacement still rework can be done.

to conclude recovery was done successfull and more than 90% data recovered
thank you