Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-29 Thread Rob Owens
On Fri, Dec 28, 2012 at 01:53:01PM +0100, berenger.mo...@neutralite.org wrote:
 This will be a problem, as you should first image the disk(s) and
 work from the images, not the physical disk. It is especially
 important for the disk throwing errors, every read attempt may worsen
 it's condition. Use tools like (g)ddrescue to make a copy despite
 read
 errors.
 
 I know, and am able to understand the why. Maybe ddrescue or
 another tool is able to build partial images? It would not be the
 panacea, but maybe a little better?
 Buying a HD of more than 1Tb (for (1), for (2) it would only be
 more than 500Gb ) is not really an idea I like, HD are not exactly
 what I name cheap.
 
I think it's doubtful that your friend's 500 Gb and 1 Tb drives are full
of photos.  I just checked my directory of photos and video clips (from
2002 to present) and it's 120 Gb.

If you use photorec, you can tell it which file types you want to
rescue.  This will allow you to ignore everything but photos for now,
and photorec will tell you (if I remember correctly) how much space
those files will take up.  You may find that you have enough storage
space after all.

-Rob


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121229193151.ga24...@aurora.owens.net



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-29 Thread Brad Alexander
On Thu, Dec 27, 2012 at 4:17 PM,  berenger.mo...@neutralite.org wrote:

 1)
 I have a hard disk (1Tb, the bigger) which gave me many errors when I am
 trying to read it. It makes it very slow to even read, but I've been able to
 determine that it contains jpg images with a classic file browser. I did not
 managed to copy any data on a safer place...
 I am feared I will not even be able to retrieve one photo with my
 conventional hardware... but maybe some of you will have an idea?

If this drive is giving errors, you might try sticking it in a plastic
bag and putting it in the freezer for a couple of hours. It may give
you some life out of a dying drive. I used this method on an old drive
(this was back around 2000 or so), and was able to get enough life
back in it to pull the data. Here is a lifehacker article from 2010
which documents it:

http://lifehacker.com/5515337/save-a-failed-hard-drive-in-your-freezer-redux

--b


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/cakmzw+av1fnzysiw_kopchforg4-pr-6eom-2k3sumvbruh...@mail.gmail.com



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread tv.deb...@googlemail.com

On 27/12/2012 22:17, berenger.mo...@neutralite.org wrote:

Ok, first, sorry to ask two questions at a time: dead drives and deleted
partitions are different things, I know that.

Let me explain my (they are, in fact, friend's problems) two problems
(from different peoples).

===
0) the common part.
By the past, I've did some researches about forensics (just as an
amateur) and learned that you mostly work on copies of media from which
you are trying to recover data.
But the 2 HD from which I need to recover images (mostly jpeg, I guess.
The users only said that's photos, ignoring, and does not willing to
know, everything about format - but if that was not computer stuff, they
would have know what they've used... - ) are bigger than all my current
disks !
This will be a problem, as you should first image the disk(s) and work 
from the images, not the physical disk. It is especially important for 
the disk throwing errors, every read attempt may worsen it's condition. 
Use tools like (g)ddrescue to make a copy despite read errors.




One is 500Gb, the other is 1Tb, where mine are mostly a bunch of 40/80Gb
+ 1 or 2 of 250Gb.

1)
I have a hard disk (1Tb, the bigger) which gave me many errors when I am
trying to read it. It makes it very slow to even read, but I've been
able to determine that it contains jpg images with a classic file
browser. I did not managed to copy any data on a safer place...
I am feared I will not even be able to retrieve one photo with my
conventional hardware... but maybe some of you will have an idea?
Again, try (g)ddrescue first, and when you have a good image work from 
that, preserving the disk from further damages.




2)
I have an external hard disk which is readable without troubles. But
partitions were probably destroyed, AFAIK. The user knows (as usual)
nothing about what happened, so I do not even know if the partition
system have been remade, or if it is simply a problem like format c:.
There are 2 partitions:
_ 1: the smaller, some Gb only IIRC, which was of type FAT when I looked
(or was it FAT32? Is it is very different?)
_ 2: the bigger, and not a little, from my memory, it takes at least 80%
of the whole disk, which is NTFS, I guess most data is there.

===

So, do someone have faced one of those problems, and come to a solution?


For the good disk where the partitions have been deleted, you can try to 
recover partitions with testdisk, it is quite efficient and fairly 
easy to use even for someone not familiar with consoles.
To recover the images, regardless of the partitions status, try 
photorec, it does a very good job most of the time and it's interface 
is self explanatory.





Of course, I've said to their owners that keeping data on only one HD is
suicidal, I've said that they can probably pay big amounts of money to
specialized establishments to have them back, and have kept their
hardware for some months (without using them), as a sanction (well, I
tried at some times to take an eye, but had other things to do).

But, now, I'm in holidays, Christmas passed, and I'm thinking that could
be an interesting gift to give back to people their photos of children
and drunken nights, and I hope someone here could help me to do that for
them :)

I've big fears that the owner of (1) will have no other choice that
asking to people with dedicated hardware, but I ask in case... for (2),
I've more hopes, IF the user stopped the destructive process before the
disk was fully erased, but I'll need the good tools.




Teach your friend(s) to backup as a Christmas gift, he'll thank you for 
the rest of is life ! ;-)
Tools like sbackup, backintime, luckybackup and the such are easy to use 
even for my mother (!) and efficient enough for single-computer personal 
use.


Good luck.


--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Archive: http://lists.debian.org/50dd6e70.1040...@googlemail.com



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread berenger . morel

I have heard good things of PhotoRec:

http://en.wikipedia.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec

But I have no personal experience of it.  The advice is always to 
copy the
drive that needs rescuing to another drive, and work on the copy, not 
the

orginal.  Again, I have not tried it.

Lisi


Thanks for the hint, I'll try it this afternoon on (2)


--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Archive: http://lists.debian.org/ae13d69406fb654cadc22ffd90995...@neutralite.org



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Ralf Mardorf
On Fri, 2012-12-28 at 12:50 +0100, berenger.mo...@neutralite.org wrote:
  I have heard good things of PhotoRec:
 
  http://en.wikipedia.org/wiki/PhotoRec
  http://www.cgsecurity.org/wiki/PhotoRec
 
  But I have no personal experience of it.  The advice is always to 
  copy the
  drive that needs rescuing to another drive, and work on the copy, not 
  the
  orginal.  Again, I have not tried it.
 
  Lisi
 
 Thanks for the hint, I'll try it this afternoon on (2)

Mount the drive read only, than there is no need to backup. There are
all kinds of commands to recover data, usually they don't recover the
data on the corrupted drive, but save the files to another place, so
it's no problem to mount a drive read only.

Regards,
Ralf


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/1356697161.2483.28.camel@q



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Ralf Mardorf
On Fri, 2012-12-28 at 13:19 +0100, Ralf Mardorf wrote:
 On Fri, 2012-12-28 at 12:50 +0100, berenger.mo...@neutralite.org wrote:
   I have heard good things of PhotoRec:
  
   http://en.wikipedia.org/wiki/PhotoRec
   http://www.cgsecurity.org/wiki/PhotoRec
  
   But I have no personal experience of it.  The advice is always to 
   copy the
   drive that needs rescuing to another drive, and work on the copy, not 
   the
   orginal.  Again, I have not tried it.
  
   Lisi
  
  Thanks for the hint, I'll try it this afternoon on (2)
 
 Mount the drive read only, than there is no need to backup. There are
 all kinds of commands to recover data, usually they don't recover the
 data on the corrupted drive, but save the files to another place, so
 it's no problem to mount a drive read only.
 
 Regards,
 Ralf

PS: Even if you make a backup first, by all means mount the drive or
partition read only, before you access it.



-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/1356697427.2483.30.camel@q



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Osamu Aoki
Hi,

On Thu, Dec 27, 2012 at 10:17:56PM +0100, berenger.mo...@neutralite.org wrote:
 Ok, first, sorry to ask two questions at a time: dead drives and
 deleted partitions are different things, I know that.
 ...
 (2), I've more hopes, IF the user stopped the destructive process
 before the disk was fully erased, but I'll need the good tools.

Look for Debian package testdisk

  http://packages.debian.org/sid/testdisk

When my PC HDD became dead completely, I used this testdisk to recover
photos on SD card in camera after erase.  Of corse, any files
overwritten by newer images were lost.  But, it was a very easy job and
I got most of the recent photos.  It guides you through nicely. (I worked
on disk image first...)

After everything went fine, I tried to run unrecommended mode --- work
directly on erased SD card.  Wow, it worked for me.

PhotoRec mentioned by  another comes as a part of testdisk suites of
tools.

I still recommends you to make disk image first.  If buying big HDD for
disk image is not your option for some reason, you may try this
dangerous direct recovery trick using some live CD and testdisk package.
It is better than doing nothing...

In any case, you should practive recovery on small test case first ...

Osamu


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121228123553.GB12575@goofy.localdomain



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Osamu Aoki
Hi,

On Fri, Dec 28, 2012 at 01:19:21PM +0100, Ralf Mardorf wrote:
 On Fri, 2012-12-28 at 12:50 +0100, berenger.mo...@neutralite.org wrote:
   I have heard good things of PhotoRec:
  
   http://en.wikipedia.org/wiki/PhotoRec
   http://www.cgsecurity.org/wiki/PhotoRec
  
   But I have no personal experience of it.  The advice is always to 
   copy the
   drive that needs rescuing to another drive, and work on the copy, not 
   the
   orginal.  Again, I have not tried it.
  
   Lisi
  
  Thanks for the hint, I'll try it this afternoon on (2)
 
 Mount the drive read only, than there is no need to backup. There are
 all kinds of commands to recover data, usually they don't recover the
 data on the corrupted drive, but save the files to another place, so
 it's no problem to mount a drive read only.

Yah, if you can mount, then it is good idea to mount as read-only first
to recover and secure data by copying them to another disk. 

But that may not get you as much data as we wish.  testdisk/photorec
tools can work on corrupted disk without using normal mounting.  You
certainly need place to write recovered data.  Making disk image and
working on it makes things easy. 

Osamu


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121228124520.GA13645@goofy.localdomain



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread berenger . morel

This will be a problem, as you should first image the disk(s) and
work from the images, not the physical disk. It is especially
important for the disk throwing errors, every read attempt may worsen
it's condition. Use tools like (g)ddrescue to make a copy despite 
read

errors.


I know, and am able to understand the why. Maybe ddrescue or another 
tool is able to build partial images? It would not be the panacea, but 
maybe a little better?
Buying a HD of more than 1Tb (for (1), for (2) it would only be more 
than 500Gb ) is not really an idea I like, HD are not exactly what I 
name cheap.




Again, try (g)ddrescue first, and when you have a good image work
from that, preserving the disk from further damages.



For the good disk where the partitions have been deleted, you can try
to recover partitions with testdisk, it is quite efficient and
fairly easy to use even for someone not familiar with consoles.
To recover the images, regardless of the partitions status, try
photorec, it does a very good job most of the time and it's
interface is self explanatory.


Thanks for the hint. I'll try this today.


Teach your friend(s) to backup as a Christmas gift, he'll thank you
for the rest of is life ! ;-)
Tools like sbackup, backintime, luckybackup and the such are easy to
use even for my mother (!) and efficient enough for single-computer
personal use.

Good luck.


Of course, but, you know people, they *usually* prefer to not worry 
until a problem comes.
I'll take a look to your tools, hopefully one run on the most common 
OS, so they might be able to use it :)



--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Archive: http://lists.debian.org/39d7d6e30fe7f6a8ef9d882d2e4b1...@neutralite.org



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Ralf Mardorf
On Fri, 2012-12-28 at 21:35 +0900, Osamu Aoki wrote:
 Hi,
 
 On Thu, Dec 27, 2012 at 10:17:56PM +0100, berenger.mo...@neutralite.org wrote:
  Ok, first, sorry to ask two questions at a time: dead drives and
  deleted partitions are different things, I know that.
  ...
  (2), I've more hopes, IF the user stopped the destructive process
  before the disk was fully erased, but I'll need the good tools.
 
 Look for Debian package testdisk
 
   http://packages.debian.org/sid/testdisk
 
 When my PC HDD became dead completely, I used this testdisk to recover
 photos on SD card in camera after erase.  Of corse, any files
 overwritten by newer images were lost.  But, it was a very easy job and
 I got most of the recent photos.  It guides you through nicely. (I worked
 on disk image first...)
 
 After everything went fine, I tried to run unrecommended mode --- work
 directly on erased SD card.  Wow, it worked for me.
 
 PhotoRec mentioned by  another comes as a part of testdisk suites of
 tools.
 
 I still recommends you to make disk image first.  If buying big HDD for
 disk image is not your option for some reason, you may try this
 dangerous direct recovery trick using some live CD and testdisk package.
 It is better than doing nothing...
 
 In any case, you should practive recovery on small test case first ...

If a drive really is broken, then it's an issue and a backup of the
complete drive, also of the deleted files is useful, if the drive isn't
broken, the data simply was deleted, then nothing bad could happen if
you mount the drive read only, no backup is needed. If you don't mount
the drive read only, but with write access enabled, then each access
could cause additional loss of deleted data.

I only can repeat, that the OP by all means should mount the drive read
only.

Hth,
Ralf


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/1356698845.2483.34.camel@q



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread berenger . morel
I only can repeat, that the OP by all means should mount the drive 
read

only.


Mounting with -ro sounds wiser to me, I think you are true.


--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Archive: http://lists.debian.org/fa959ad0dc4c74e09b3981513f7e6...@neutralite.org



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Federico Alberto Sayd

On 27/12/12 18:17, berenger.mo...@neutralite.org wrote:
Ok, first, sorry to ask two questions at a time: dead drives and 
deleted partitions are different things, I know that.


Let me explain my (they are, in fact, friend's problems) two 
problems (from different peoples).


===
0) the common part.
By the past, I've did some researches about forensics (just as an 
amateur) and learned that you mostly work on copies of media from 
which you are trying to recover data.
But the 2 HD from which I need to recover images (mostly jpeg, I 
guess. The users only said that's photos, ignoring, and does not 
willing to know, everything about format - but if that was not 
computer stuff, they would have know what they've used...  - ) are 
bigger than all my current disks !
One is 500Gb, the other is 1Tb, where mine are mostly a bunch of 
40/80Gb + 1 or 2 of 250Gb.


1)
I have a hard disk (1Tb, the bigger) which gave me many errors when I 
am trying to read it. It makes it very slow to even read, but I've 
been able to determine that it contains jpg images with a classic file 
browser. I did not managed to copy any data on a safer place...
I am feared I will not even be able to retrieve one photo with my 
conventional hardware... but maybe some of you will have an idea?


2)
I have an external hard disk which is readable without troubles. But 
partitions were probably destroyed, AFAIK. The user knows (as usual) 
nothing about what happened, so I do not even know if the partition 
system have been remade, or if it is simply a problem like format c:.

There are 2 partitions:
_ 1: the smaller, some Gb only IIRC, which was of type FAT when I 
looked (or was it FAT32? Is it is very different?)
_ 2: the bigger, and not a little, from my memory, it takes at least 
80% of the whole disk, which is NTFS, I guess most data is there.


===

So, do someone have faced one of those problems, and come to a solution?

Of course, I've said to their owners that keeping data on only one HD 
is suicidal, I've said that they can probably pay big amounts of money 
to specialized establishments to have them back, and have kept their 
hardware for some months (without using them), as a sanction (well, I 
tried at some times to take an eye, but had other things to do).


But, now, I'm in holidays, Christmas passed, and I'm thinking that 
could be an interesting gift to give back to people their photos of 
children and drunken nights, and I hope someone here could help me to 
do that for them :)


I've big fears that the owner of (1) will have no other choice that 
asking to people with dedicated hardware, but I ask in case... for 
(2), I've more hopes, IF the user stopped the destructive process 
before the disk was fully erased, but I'll need the good tools.




You can also try foremost.


--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Archive: http://lists.debian.org/50ddab64.1010...@uncu.edu.ar



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Cybe R. Wizard
On Fri, 28 Dec 2012 21:45:20 +0900
Osamu Aoki os...@debian.org wrote:

 Hi,
 
 On Fri, Dec 28, 2012 at 01:19:21PM +0100, Ralf Mardorf wrote:
  On Fri, 2012-12-28 at 12:50 +0100, berenger.mo...@neutralite.org
  wrote:
I have heard good things of PhotoRec:
   
http://en.wikipedia.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec
   
But I have no personal experience of it.  The advice is always
to copy the
drive that needs rescuing to another drive, and work on the
copy, not the
orginal.  Again, I have not tried it.
   
Lisi
   
   Thanks for the hint, I'll try it this afternoon on (2)
  
  Mount the drive read only, than there is no need to backup. There
  are all kinds of commands to recover data, usually they don't
  recover the data on the corrupted drive, but save the files to
  another place, so it's no problem to mount a drive read only.
 
 Yah, if you can mount, then it is good idea to mount as read-only
 first to recover and secure data by copying them to another disk. 
 
 But that may not get you as much data as we wish.  testdisk/photorec
 tools can work on corrupted disk without using normal mounting.  You
 certainly need place to write recovered data.  Making disk image and
 working on it makes things easy. 
 
 Osamu
 
 
I second the use of photorec, part of testdisk.  Working on the dead
drive directly, it recovered all of my 'lost' photos, a holiday special.

Cybe R. Wizard
-- 
Nice computers don't go down.
Larry Niven, Steven Barnes
The Barsoom Project


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121228090613.12027087@wizardstower



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Osamu Aoki
Hi,

On Fri, Dec 28, 2012 at 01:23:47PM +0100, Ralf Mardorf wrote:
...
 PS: Even if you make a backup first, by all means mount the drive or
 partition read only, before you access it.

Hmmm... Maybe I was too short on explanation.

The best practice is NOT TO MOUNT AT ALL.

If your desktop system auto mount disk, just run like:

$ sudo mount
... check output to see if device is automounted:
$ sudo umount /dev/sdc1 (or what ever disk partition mounted)

(It is better not to face this situation but this tends to happen
unintentionally.)

Use dd to make disk image.  For that you do not need to mount
drive.  From root with /dev/sdc being bad drive and /dev/sdd being good
bigger drive, do this first.

root # dd if=/dev/sdc of=/dev/sdd

This is the best way to get a safe copy to work with the testdisk
command on the copy.  This way, recovered data is safe too.

See more on this
 
http://www.debian.org/doc/manuals/debian-reference/ch10.en.html#_making_the_disk_image_file


Osamu

PS: I am not recommending to mount nor work on the original data disk.



-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121228182608.GB11977@goofy.localdomain



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-28 Thread Lisi Reisz
On Friday 28 December 2012 18:26:08 Osamu Aoki wrote:
 PS: I am not recommending to mount nor work on the original data disk.

Several people have said that Osamu, including me - even if less eruditely 
than you.  But the difficulty is that the problem disk does not belong to the 
OP, but to a friend.  And the OP is reluctant (understandably!) to buy a 
large HDD just to rescue his friend's data.

Though he could perhaps persuade the friend to buy one if he wants his data 
rescued. ;-)

Lisi


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/201212282343.54664.lisi.re...@gmail.com



Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-27 Thread berenger . morel
Ok, first, sorry to ask two questions at a time: dead drives and 
deleted partitions are different things, I know that.


Let me explain my (they are, in fact, friend's problems) two problems 
(from different peoples).


===
0) the common part.
By the past, I've did some researches about forensics (just as an 
amateur) and learned that you mostly work on copies of media from which 
you are trying to recover data.
But the 2 HD from which I need to recover images (mostly jpeg, I guess. 
The users only said that's photos, ignoring, and does not willing to 
know, everything about format - but if that was not computer stuff, they 
would have know what they've used...  - ) are bigger than all my current 
disks !
One is 500Gb, the other is 1Tb, where mine are mostly a bunch of 
40/80Gb + 1 or 2 of 250Gb.


1)
I have a hard disk (1Tb, the bigger) which gave me many errors when I 
am trying to read it. It makes it very slow to even read, but I've been 
able to determine that it contains jpg images with a classic file 
browser. I did not managed to copy any data on a safer place...
I am feared I will not even be able to retrieve one photo with my 
conventional hardware... but maybe some of you will have an idea?


2)
I have an external hard disk which is readable without troubles. But 
partitions were probably destroyed, AFAIK. The user knows (as usual) 
nothing about what happened, so I do not even know if the partition 
system have been remade, or if it is simply a problem like format c:.

There are 2 partitions:
_ 1: the smaller, some Gb only IIRC, which was of type FAT when I 
looked (or was it FAT32? Is it is very different?)
_ 2: the bigger, and not a little, from my memory, it takes at least 
80% of the whole disk, which is NTFS, I guess most data is there.


===

So, do someone have faced one of those problems, and come to a 
solution?


Of course, I've said to their owners that keeping data on only one HD 
is suicidal, I've said that they can probably pay big amounts of money 
to specialized establishments to have them back, and have kept their 
hardware for some months (without using them), as a sanction (well, I 
tried at some times to take an eye, but had other things to do).


But, now, I'm in holidays, Christmas passed, and I'm thinking that 
could be an interesting gift to give back to people their photos of 
children and drunken nights, and I hope someone here could help me to do 
that for them :)


I've big fears that the owner of (1) will have no other choice that 
asking to people with dedicated hardware, but I ask in case... for (2), 
I've more hopes, IF the user stopped the destructive process before the 
disk was fully erased, but I'll need the good tools.



--
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org

Archive: http://lists.debian.org/8223a671facf8ab779f30e7156003...@neutralite.org



Re: Tools to retrieve images from dead hard drive and/or deleted partitions

2012-12-27 Thread Lisi Reisz
On Thursday 27 December 2012 21:17:56 berenger.mo...@neutralite.org wrote:
 Ok, first, sorry to ask two questions at a time: dead drives and
 deleted partitions are different things, I know that.

 Let me explain my (they are, in fact, friend's problems) two problems
 (from different peoples).

 ===
 0) the common part.
 By the past, I've did some researches about forensics (just as an
 amateur) and learned that you mostly work on copies of media from which
 you are trying to recover data.
 But the 2 HD from which I need to recover images (mostly jpeg, I guess.
 The users only said that's photos, ignoring, and does not willing to
 know, everything about format - but if that was not computer stuff, they
 would have know what they've used...  - ) are bigger than all my current
 disks !
 One is 500Gb, the other is 1Tb, where mine are mostly a bunch of
 40/80Gb + 1 or 2 of 250Gb.

 1)
 I have a hard disk (1Tb, the bigger) which gave me many errors when I
 am trying to read it. It makes it very slow to even read, but I've been
 able to determine that it contains jpg images with a classic file
 browser. I did not managed to copy any data on a safer place...
 I am feared I will not even be able to retrieve one photo with my
 conventional hardware... but maybe some of you will have an idea?

 2)
 I have an external hard disk which is readable without troubles. But
 partitions were probably destroyed, AFAIK. The user knows (as usual)
 nothing about what happened, so I do not even know if the partition
 system have been remade, or if it is simply a problem like format c:.
 There are 2 partitions:
 _ 1: the smaller, some Gb only IIRC, which was of type FAT when I
 looked (or was it FAT32? Is it is very different?)
 _ 2: the bigger, and not a little, from my memory, it takes at least
 80% of the whole disk, which is NTFS, I guess most data is there.

 ===

 So, do someone have faced one of those problems, and come to a
 solution?

 Of course, I've said to their owners that keeping data on only one HD
 is suicidal, I've said that they can probably pay big amounts of money
 to specialized establishments to have them back, and have kept their
 hardware for some months (without using them), as a sanction (well, I
 tried at some times to take an eye, but had other things to do).

 But, now, I'm in holidays, Christmas passed, and I'm thinking that
 could be an interesting gift to give back to people their photos of
 children and drunken nights, and I hope someone here could help me to do
 that for them :)

 I've big fears that the owner of (1) will have no other choice that
 asking to people with dedicated hardware, but I ask in case... for (2),
 I've more hopes, IF the user stopped the destructive process before the
 disk was fully erased, but I'll need the good tools.

I have heard good things of PhotoRec:

http://en.wikipedia.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec

But I have no personal experience of it.  The advice is always to copy the 
drive that needs rescuing to another drive, and work on the copy, not the 
orginal.  Again, I have not tried it.

Lisi


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/201212272342.53397.lisi.re...@gmail.com