1

I accidentally erased a 2 TB harddisk while trying to create ubuntu startup disk on my 2GB pendrive. Instead of erasing the 2 GB pendrive I think I erased the 2TB external hardisk using the Startup Disk Creator. It took only less than 5 seconds for the startup disk creator to erase my 2TB external harddisk. Also when I open the affected external 2TB drive there are no files visible, but the properties of the disk shows 1.2TB of the space as used (same as the size of the data I had stored in it previously before accident). Please see this image.

So I believe that the original data is somewhere in broken/invisible formats inside the disk. That is my only hope. I don't have a alternate 2TB harddisk to take a backup or to perform testing. I can neither avail or afford one right now in my place. So I don't want to mess up further by choosing a wrong recovery method on the original affected disk. My clients would be mad to listen to these stories for delays in my current deliverable, but getting fired or loosing business is the least of my problems now. This external hardisk is more important and is everything I had in my life and career.

To recover the data, I have already gathered ideas about testdisk and photorec from this posting and several others in google. I didn't try any of them on the affected hard disk. But I did try both testdisk and photorec on other portable devices for testing purpose. For instance, I tested them on a pendrive and retrieved files like a broken pieces from postmortem. It will be of no use, if that is what the recovery tools can provide it will be too impossible for me to rearrange, rename and understand the data/files of total size which is around 1.5 TB. The data involves most possible formats of images, sounds, videos, scripts, programs, codes, design files etc.. Isn't there a way to just undo this accident (that took only 5 seconds) and get back all my files as it is? Because the properties of the external drive still shows 1.2 Tb as used and only 800 GB out of 2 TB as free.

I would loose 10 years of my life's work, designs, programs, all critical files, projects and priceless family memories. I am a living dead if I can't get back my data. Most of the post with similar issues are dated 2012 or before, so I believe there should have been some technology improvements to undo this by now. I know I am foolish to have something that I considered worth more than my life in one single external Hard disk. But it had been that way ever since I started computing and I never faced any single issue so far. I was using windows and only recently I switched to ubuntu. And I made this mess while using ubuntu's in-built Startup disk creator. Infact the hard-disk was only my backup and I used to have the working copies in my laptop. But my bad time, I had also crashed my laptop recently while I was trying to render an animation using Blender and this week I lost the main backup data in hard-disk too. I can never recover from this tragedy and I request that if anyone knows a solution to recover data and files from the 2Tb hard-disk data, please share me.

Please help! Should I run testdisk or photorec on my external Hard disk? Can it restore all the files as it is? Or do we have any other solution to resolve this, as my hard-disk is not totally empty and it's properties shows 1.2Tb as used space?

regards,

K

Improve this question
2

3 Answers 3

Reset to default
1

I have had this problem and it seems, you have to purchase a non-free to get the files as they are with all folders. Photorec is very powerful and it will centrally recover all your files till they were not over written but they will be renamed and sorted in folders according to photorec's policy.

R-studio is great one that supports multiple platform and all major file systems. It saved my arse back than.

Best of luck.

VVI : Back up !!!!! Back up !!!!! Back up !!!!!

Edit: this kind of problem has been solved here :)

Instructions step-by-step:

`Install TestDisk
 Mount the drive
 Launch sudo testdisk (eventually enlarge the terminal)
 Create a new log file
 Select the drive
 Select partition Table (usually Intel should be good)
 Analyse
 Quick Search (this should found only the actual partition)
 [Enter]
 Deeper Search (this should find your old partition, you can stop it after it found  it) Once you found what you think it's your partition select it with up/down arrows
 [P] for list files and look if it seems it
 [q] to quit list files
 [Enter]
 Write to save new partition table to MBR.`

Look carefully: this don't overwrite / recover any data, just the MBR of the disk.

Source: Recover 1TB disk erased with startup disk creator

Improve this answer
6
  • The recovery programs retrieves files with random names and I hope it will not be possible to achieve the exact original folder structure. For example I had sharp/mono develop projects, website projects, blender project which were maintained as sets in folders and zip files. Will any recovery option restore the original state of the files in the same folder structure? Besides as you would have noticed in the image I posted, it shows 1.2 TB as used space. So do you think that the files that are currently invisible with 1.2 Tb size can be brought back to visibility by any other means?
    – Kshatriya
    Jun 1, 2013 at 20:35
  • You should of course try testdisk to see if it can retrieve the original partition table and if that happens then hopefully it may start indexing your files too. But first of all backup the hard disk before applying testdisk as it will over write the starting sectors which may corrupt some files tho it's minimal.
    – 22lk94k943 only
    Jun 1, 2013 at 20:45
  • Saw the image now, you should try testdisk.
    – 22lk94k943 only
    Jun 1, 2013 at 20:48
  • Thankyou. I will try to see if I can get a equivalent harddisk in my place and it would take some weeks. Then I will backup and try the recovery methods directly. Is it possible to run recovery on virtual disks which are obtained from the ISO copies of the original drive?
    – Kshatriya
    Jun 1, 2013 at 20:54
  • Ya you have to mount it. But why will you copy it as iso when you can copy the whole partition table to another disk of same or more space. see here too. The logfile option is just a cool breeze.
    – 22lk94k943 only
    Jun 1, 2013 at 21:06
0

Try Scalpel data recovery software.

Scalpel can be run on various operating systems like Linux, Windows, MacOS. File systems on which Scalpel can perform recovery, also vary ranging from FATx, NTFS, Ext2, Ext3, HFS+ partitions to raw data. To install it, just press Ctrl+Alt+T on your keyboard to open Terminal. When it opens, run the command(s) below:

sudo apt-get install scalpel

To use Scalpel, take a look at

man scalpel

Also, you may want to take a look at Data Recovery

Now what I would really do if the data is too important, I would seek professional data recovery help.

Source:ForensicsDigital

Improve this answer
2
  • Thanks for your suggestion. I will test scalpel as you suggested. Professional help also would be great but there are lot of confidential data I will have to risk, so it would be better if I can handle it myself. Besides the data recovery option is there any other way I can see the files which are not visible or hidden but still occupies a space of 1.2Tb in the existing 2 TB? As you would see in the image I posted. Or do you think there is really something in it to occupy that space?
    – Kshatriya
    Jun 1, 2013 at 20:07
  • Your confidential data will be safe. I've used Ontrack, and they are very professional.
    – Mitch
    Jun 1, 2013 at 20:11
-2

Simple. Connect it, mount it, use dd if=(path) of=(path) Please let me know if you need any further help on this.

Improve this answer
7
  • Hi, Thanks for your quick reply. I hope this command can be very useful to clone my disk into another to have a backup. But can you please elaborate if this would restore my files and folders?
    – Kshatriya
    Jun 1, 2013 at 19:41
  • @user163168 Sure! This will do a block-by-block replica of the data on the disk. Simply attach it, mount it, then as an example dd if=/dev/sdb of=/dev/sbc where sdb is the victim disk and sdc is the target to recover the data to. Once you have the data safely copied off to a good location, you can read-only mount the copy you made and find/extract the intact files from there.
    – RGS
    Jun 1, 2013 at 19:46
  • Thanks again. But since the data I want to retrieve here is around 1.2 TB, First I need to avail an another 2TB Harddisk to make the copy using dd command. I will try to get a 2TB harddisk and then will try this. Meantime is there any other solutions to work only using the existing single 2TB disk?
    – Kshatriya
    Jun 1, 2013 at 19:56
  • @Kshatriya, anything you do to that original disk risks losing everything. Since you didn't bother with backups, I would highly advise you do not run any tools against it other than to take an image.
    – Cry Havok
    Jun 1, 2013 at 20:30
  • Thankyou I will not use any tools directly as of now, until I will have a complete backup. I am only wondering why the disk shows 1.2Tb as used space if it has been erased fully. So does it mean that the data is still there and only the partition table or something like that is corrupted? And maybe if I can restore that table the files which might now be invisible but occupies 1.2Tb space may then become visible?
    – Kshatriya
    Jun 1, 2013 at 20:41

Not the answer you're looking for? Browse other questions tagged .