Help Recover partition on External ntfs Drive with Linux

[johnywhy]

hi

can someone direct me to a guide for recovering an ntfs volume?

the drive can mount, and reports nearly full, but appears to be empty in file-manager.

it's an external usb ntfs-formatted 500 GB HD. Last time i checked, the disk had a couple hundred GB of files on it (but NOT almost full as now reporting).

now all the files are gone, and the drive reports "68 GB" free. the partition is visible, but it's empty.

really appreciate any help, these are my only backups of some important files.

at first, gparted info reported "cluster accounting failed".

then i tried the following:

# e2fsck -n /dev/sdb1
e2fsck 1.42.8 (20-Jun-2013)
ext2fs_open2: Bad magic number in super-block
e2fsck: Superblock invalid, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/sdb1

The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

# ntfsfix /dev/sdb1
Mounting volume... OK
Processing of $MFT and $MFTMirr completed successfully.
Checking the alternate boot sector... OK
NTFS volume version is 3.1.
NTFS partition /dev/sdb1 was processed successfully.

# fsck /dev/sdb1
fsck from util-linux 2.21.2
fsck: fsck.ntfs: not found
fsck: error 2 while executing fsck.ntfs for /dev/sdb1

# fsck /dev/sdb
fsck from util-linux 2.21.2
e2fsck 1.42.8 (20-Jun-2013)
ext2fs_open2: Bad magic number in super-block
fsck.ext2: Superblock invalid, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open /dev/sdb

The superblock could not be read or does not describe a correct ext2
filesystem.  If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
    e2fsck -b 8193 <device>

# ntfsfix /dev/sdb
Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

after the above, and before mounting the drive, gparted displays an exclamation icon and says:

Unable to read the contents of this file system!
Because of this some operations may be unavailable.
The cause might be a missing software package.
The following list of software packages is required for ntfs file system support: ntfsprogs / ntfs-3g.

but, i can mount it. after mounting, gparted says:


thx!

 

[DrParker]

This sequence of commands appears to have altered some of the file system metadata structures. At a data recovery company, this is one of the worst scenarios we encounter, where attempts, all well-meaning have been made to recovery the data.

This is a reminder of why we always secure an image copy of the disk that we're working on, and never work on the live disk, once this has been done.

What damage running these tools has done can only be divined by looking directly at the data. The damage could range from only a small change to the first entries to the Master File Table (MFT) right through to wholesale destruction of file entries. Hopefully it is the former, and you're able to find a way, either through a data recovery company, which would be my recommendation or via other software to recover the data.

Dr Parker, Software engineer and webmaster for DiskEng, Oxford, UK.

http://www.DiskEng.com

 

[johnywhy]

thx for reply.

this has been resolved.

Solution:
- In Linux, use ddrescue to make an image-file of the disk.
- Launch Hirens Rescue CD Mini XP:
-- Use ImgMount to mount the image-file.
-- Run chkdsk on the mounted drive. Files are recovered. Some files are in "found" folders.
-- Use windows explorer to copy the files from the mounted image-file to a safe location.

details here:
[URL unfurl="true"]http://www.murga-linux.com/puppy/viewtopic.php?t=99196[/url]

 

[johnallen3421]

Use Recuva or Disk Drill to recover your deleted files. Both are freeware