Thursday, April 26, 2012

File recovery with PhotoRec

I've used Gparted as a free partitioning tool for at least six years and have very rarely had a problem with it.
Yes, warning have come up, saying that to proceed might cause a boot failure, as I've tried to move around or shrink/expand particularly logical partitions, but I've ignored them with, up to now, no consequence.
But lately, using Parted Magic (which includes Gparted in an extremely useful package of apps) version, I seem to have a problem almost every time I use it.
The most common problem by far is, as the warning says, a failure to boot which is announced by a cryptic grub message on an otherwise uninviting black page.
Luckily this is easily rectified, assuming that none of the partition file systems have been corrupted (no further yellow triangles in Gparted), by re-installing Grub2 in the mbr.
Here's how (see this link for details):

1. Boot to a live Ubuntu CD (or USB key)

2. Use "df -h" to find the designation of the partition whose Grub you want to re-install in the mbr.
(let's assume it's /dev/sda6 which is what is was for me)

3. Mount this partition in the Live CD environments

# mount /dev/sda6 /mnt

4. grub-install --root-directory=/mnt /dev/sda

After this you should get a message telling you the install went fine without errors.

5. Now just reboot, after ejecting the Live CD medium, and enjoy.


However, the errors are not always so easily rectified.
A few days ago I tried to get Gparted to move and resize the /home of Ubuntu in a partition containing quite a few other OSes.
However, the /home became corrupted and was no longer accessible through conventional means.
Thus Gparted didn't recognize its file system and it could be mounted from a Live CD.
Seems, the superblock for the partition was corrupted.
This post seemed to offer a solution by substituting the backup superblocks.
However, didn't work for me and I tried all of the available backup superblocks several times.
Indeed, Testdisk showed me later that this particular partition had no backup superblocks.

Testdisk is a really great tool and I'm surprised that I hadn't really ever used it up to now.
Indeed, it also included in Parted Magic.

After many abortive attempts I finally came across a howto that resolved to a large extent my problem.
This involved using dd_rescue to copy the corrupted partition to an external drive.
This got me 85GB of recovered files.
Next, I used photorec, which is a part of the Testdisk suite, to recover all  my recovered files (not just the photos as the app's name might imply) to the Ubuntu /home on another computer (/home was more than 100GB in size which was need to house the 85GB recovered.

Recovery was completed in about 90 minutes which is very quick.

However, all was not perfect.
All, files had lost their names and became something like f8947289.txt.
Now when about 25,000 files were recovered this is inconvenient to say the least.
Furthermore, although I retrieved more than 6,000 mp3's, I played 5 of them (at random) and only one actually finished although of the others, all played at least 75% of the way through.
Once again, however, all names were missing from mp3 files.
Additionally, I got back about 7,500 .jpg files (photos).
However, of those I looked at they were only thumbnails rather than full-blown 2-5 MB photos.

Need to more thoroughly analyze exactly what I got back.
However, at this stage I'm thankful that everything I "lost" was already backed up.







No comments:

Post a Comment