Testdisk Commands help

[milescortez]

Hi---God I really hope someone out there can help me. Here is the story. Working with a Lacie 1TB ethernet big disk comprised of 2 seagate 500GB disks. I deleted some shares and end up not being able to see my data. I am fairly certain there is nothing physically wrong with the drive. it appears to be a logical problem.

I've reassembled my new disks in Ubuntu and can see them using sudo fdisk -1 as both individual disks and as the combined 1TB disk.

I used ddrescue to create an image and logfile. Here is the logfile:
# Rescue Logfile. Created by GNU ddrescue version 1.11
# current_pos current_status
0xE8A4070200 +
# pos size status
0x00000000 0xE8A4080000 +

My question is how can I use testdisk on the image file---what is the command line entry. I;ve tried everything. both the image and the logfile are stored at /media/mybook_/lacie3.image and /media/mybook_lacie3.logfile

I know the data is on there because I can see it through recovermyfiles or other XP based data receovery software. My issue is I want to be able to pull off the data and preserve the folder and file structure. Alot of the data was mddate and mdinfo files which are iphone backup files which are very important to me for legal reasons.

Please help----I've been dealing with this for 2 weeks. i am trying to use the image file b/c the satas connections kept getting dropped. I believe what happen to the drive is that of the 7 or 8 partitions on the drive, the data partition is fine. The whole drive is fine if I connect via ethernet or USB (i.e. not direct to sata connections) Ijust can;t see the data. The drive shows up as empty even though there was about 700GBs of data.

I am at the end of my rope----It's so frustrating cause I know its there! Also totally open to other data receovery suggestions!

Thanks in advance---Miles

[drc]

You should be able to do "testdisk /media/mybook_lacie3.image" and have it show up as a hard drive in the list

As always, imaging the drives before making any changes to them is essential

[milescortez]

I've tried that. I get "unable to open file or device /media/mybook_/lacie3.image".

I've tried /media/mybook_lacie3 image, /media/mybook_/lacie3.image. Shouldn't there be a "/" between the mybook_ and the file name?

I don;t get it because that is the path that I used when I created the .image and .logfile files from dd rescue. The image file is showing up as a 930 GB file on the mybook (WD 2TB USB storage device). It's definitely there.

Am I maybe having problems because the mybook is mounted? Or could it be that the .image file should be a .iso .dd. or .img file? I am hoping I don;t have to go through imaging again.

[drc]

Shouldn't there be a "/" between the mybook_ and the file name?

In your previous message you typed it one way one time and a different way the other time. If your external is indeed mounted at "/media/mybook_/" and your image file is indeed named "lacie3.image" then you are correct, it should be "testdisk /media/mybook_/lacie3.image". If it is having problems with that, then maybe it doesn't like the underscore at the end of the dir name or something.

[milescortez]

Shouldn't there be a "/" between the mybook_ and the file name?

In your previous message you typed it one way one time and a different way the other time. If your external is indeed mounted at "/media/mybook_/" and your image file is indeed named "lacie3.image" then you are correct, it should be "testdisk /media/mybook_/lacie3.image". If it is having problems with that, then maybe it doesn't like the underscore at the end of the dir name or something.

AH HA----the folder was mybook__ (two underscores) for some reason when it mounted again it put a second folder in there. One folder with the one undersacore (with no files) and a second mounted folder with two underscores---with the files. Running testdisk now---I'll report back with results.

Thanks for the help!

[milescortez]

Can someone help me understand this? This is what the assembled imaged spit out but it doesn;t seem right. When I looked at the two drives indiviudally one drive (the first one) had about 8 partitions on it---mostly what looked like small system partitions and one large data partition. The second drive had no file system and just one large data partition. How can I get my data off of this thing. I figured after speaking with Lacie that I needed to assemble the drive as one drive to get the data but this makes me think I maybe want to try and pull the stuff off one drive at a time.

Disk /media/mybook__/lacie3.image - 999 GB / 930 GiB - CHS 121478 255 63
Partition Start End Size in sectors
L HFS 49070 2 1 54249 254 63 83216574

TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /media/mybook__/lacie3.image - 999 GB / 930 GiB - CHS 121478 255 63

Partition Start End Size in sectors

1 E extended LBA 49070 1 1 54249 254 63 83216637
5 L HFS 49070 2 1 54249 254 63 83216574

[milescortez]

Shouldn't there be a "/" between the mybook_ and the file name?

In your previous message you typed it one way one time and a different way the other time. If your external is indeed mounted at "/media/mybook_/" and your image file is indeed named "lacie3.image" then you are correct, it should be "testdisk /media/mybook_/lacie3.image". If it is having problems with that, then maybe it doesn't like the underscore at the end of the dir name or something.

AH HA----the folder was mybook__ (two underscores) for some reason when it mounted again it put a second folder in there. One folder with the one undersacore (with no files) and a second mounted folder with two underscores---with the files. Running testdisk now---I'll report back with results.

Thanks for the help!

So this is what a partial img from the first disk looks like if I run testdisk on just the FS 1st drive rather than the assembled drive. Can anyone make sense of this?

Disk /media/buffalomount/backup2.img - 360 GB / 335 GiB - CHS 43785 255 63
Current partition structure:
Partition Start End Size in sectors

1 E extended 0 1 1 124 254 63 2008062
2 P Linux 125 0 1 60800 254 63 974759940
No partition is bootable
5 L Linux Swap 0 2 1 15 254 63 256914
X extended 16 0 1 16 254 63 16065
No EXT2, JFS, Reiser, cramfs or XFS marker
6 L Linux 16 1 1 16 254 63 16002
6 L Linux 16 1 1 16 254 63 16002
X extended 17 0 1 17 254 63 16065
7 L Linux 17 1 1 17 254 63 16002
X extended 18 0 1 33 254 63 257040
8 L Linux 18 1 1 33 254 63 256977
X extended 34 0 1 124 254 63 1461915
9 L Linux 34 1 1 124 254 63 1461852