Help! TestDisk usage for data hard drive recovery?

[louarnold]

I am using TestDisk to try to recover the a data hard drive (1 data partition) that I accidentally wrote on (4GB) with "dd". Can someone help?

Output is as follows:
---
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
Partition Start End Size in sectors
>* Linux 0 32 33 60801 80 15 976771072 [WD500GP1]
....
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
ext3 blocksize=4096 Large_file Sparse_SB, 500 GB / 465 GiB
------
I listed the files; some are marked as deleted, but a folder that holds all the files is marked as intact. TestDisk has a copy command. Should I copy these files somewhere first, before I create the MBR? Should I use PhotoRec before that to recover files. I haven't found any guidance on this?

Now, I'm not sure what the correct "partition characteristics" should be for this 500GB sole partition. Anyone know?
Recall that 4GB was set to zero.

Does anyone know if TestDisk has used the back-up partition metadata to find the info shown?
Regards.

[aks]

I've not had much luck with TestDisk in the past.

[louarnold]

Before using TestDisk, I had to stop the automatic emergency mode boot that CentOS was taking by stopping the mount of the partition /dev/sdb1. To do that, I copied the /etc/fstab file to a backup name and the edited the file to remove the automount line that mounts the problem partition (/dev/sdb1). I then rebooted.I got a normal boot to GUI and was then able to run TestDisk.

Re TestDisk... It worked quite well actually. All I had to do was write the partition table that it had discovered. Many files were lost, but many more were retained - to my surprise. In the end, I found other backups off this computer, that had the files that were lost.

At the very start, TestDisk looks for all the drives, and when you pick one it looks for all the partitions on that drive. Pick a partition and it determines the start and stop blocks of data in that partition. It also looks at all the folders and files in that partition and determines which files are present and which are deleted.

Its a very finicky program and the documentation is rather poor. For example, it doesn't explain if one should copy existing files first (to another partition, anyway) or just write the partition info. In fact the latter is true; the files are retained after the partition writing is done.

FYI for copying files: To copy files you must pick the "." file in the destination directory listing; otherwise, you may find the copies in unexpected places. Furthermore, it seems to fail at copying many files, although I suppose that must be expected.

As it happened, TestDisk saved the day/night.

[MartinR]

In general, when dealing with a disk problem, advice is to copy an image of the disk (dd if=/dev/sdd of=/home/sdd.img for example), and then work on the image. Would this technique work with TestDisk?

[maikel]

Yes, that will work, because it copies laterally everything (all the zero's and ones).
I recovered successfully many hard disks. Only work with the image and store safely the original one.

[aks]

What I meant was that TestDisk is not very good at reconstructing lost data from fragments....

[louarnold]

What I meant was that TestDisk is not very good at reconstructing lost data from fragments....

That was an interesting comment. What else would you use?

[TrevorH]

Imagination?

[louarnold]

Imagination?

LOL. VERY GOOD!

[aks]

Depends on what was there. There are some "specialist" recovery programs (mainly for graphical files) - most of these depend on having the metadata signature intact (to be able to identify the file type). Generally the way this'll work is start of file to end of file marker (starting at block xxx running for xxx blocks ending at block xxx) - in other words you have to map out the entire disk, taking into account "abstractions" like LBA, RAID etc. - not a trivial task especially for the larger disks that are available now.
I'm not aware of any free (libre or otherwise) software that'll do this.
So yeah, imagination is probably the best way forward....