4

I'm trying to recover from an accidental format of ext4 1TB HDD. I tried virtually all Linux tools (extundelete, ext3grep, ext4magic, testdisk, photorec, and others). Some that worked: testdisk, photorec and foremost. They recovered some 300000 files, but they didn't recover the hdd folder structure, which is very important to me because I had many projects and important documents in this HDD. They just recovered files and put them in folders divided by extension or some in a unique folder. extundelete couldn't find anything. ext3grep and ext4magic crashed.

I'm trying for more than a week to find a tool that recover folder structure with no luck.

Is this possible ? I mean recover files inside the correct folder structure ?

History

I accidentally formatted it and immediately shut down the computer. It was a data only HDD with no file system files in it. I initially thought I had a good chance of recovering it, but I'm start to think I'll have to deal with organizing thousands of files.

I have searched many forums, and help sites like this and couldn't find anything that works.

In order to recover from it I bought a Blackarmor NAS with 6TB space, so I have plenty of room to any recovery operation.

All utilities mentioned above, as well as all the recovered files were recovered not from the unit itself, but from an image I've made with dd.

The HDD itself is physically OK. No damaged sectors or malfunctions.

At this point, I'm not getting anywhere, so I sent the physical HDD to a data recovery company.

Any advice about recovering files and folder structure can only be based now on the image I have.

Improve this question
8
  • 7
    think of this as a valuable lesson about the importance of backups.
    – cas
    Commented Apr 20, 2016 at 1:24
  • 1
    I was the one saying that all my life... and now here I am in this situation. I used to say: have you tested the backup after creating it ? if you didn't test it you ain't got a backup. :/
    – Nelson Teixeira
    Commented Apr 20, 2016 at 1:27
  • 3
    I must not be careless. Carelessness is the file killer. Carelessness is the little death that brings total obliteration. I will perform my backups. I will permit them to pass out the door and off the site. And when it is offsite I will still take care with all my commands. Where the backup is safe there will be no danger. All my files will remain.
    – cas
    Commented Apr 20, 2016 at 1:29
  • you may have luck - if you just formatted it without option of secure formatting or overwriting with 0s and/or 1s - the a simple format comand will only create a new partition table on the disk and not actually touch ani of the bits stored on it - there exists a few data recovery tools - one of them or a combination may help you - can you tell us what kind of data it was - maybe pictures then i recomend you photorec cgsecurity.org/wiki/PhotoRec_DE if it more other data then i would try testdisk first cgsecurity.org/wiki/TestDisk
    – konqui
    Commented Apr 29, 2016 at 6:37
  • 1
    sorry but as i read it there was way less content in your question - maybe my add blocker removed some stuff or the page didn't load correct - anyway - now it looks like your main question is if there is a tool or way to recover the folder structure - since folders are just files containing a list of inodes it contains and the associated names i think you can't recover your folder structure at least i never heard of a tool that can recover those directory files and if they could they may be use less sinze the inodes of the recovered files will have changed from them of the real files.
    – konqui
    Commented Apr 30, 2016 at 7:38

1 Answer 1

Reset to default
2
+25

The forensic tools the recovery company will use could include EnCase Forensic, which is probably the leading forensic data recovery utility. EnCase takes the drive image recovers the raw data, then makes pretty intelligent assumptions as to what blocks form what files.

There are still limitations, so an element of this is likely to be manually processed.

On a Windows machine you'd likely have a copy of your Master File Table. Sadly, under ext4 this doesn't exist, but you can make reasonable assumptions based on inode timestamps and other metadata.

Improve this answer
5
  • I searched Encase in google and found this site: bit.ly/1SRrdxM. There I found 4 softwares named Encase, namely: EnCase Endpoint Security, EnCase eDiscovery, EnCase Forensic, EnCase Endpoint Investigator. Which one is the one you're talking about ?
    – Nelson Teixeira
    Commented May 5, 2016 at 16:11
  • 1
    @NelsonTeixeira Read the product pages and you'll see, Forensic is the one you'd want for this sort of job.
    – Iszi
    Commented May 5, 2016 at 16:31
  • U$3600 is REAALLLYYYY way above my budget. :D
    – Nelson Teixeira
    Commented May 5, 2016 at 16:33
  • @NelsonTeixeira EnCase is really enterprise/professional-grade software. And it comes with a matching price tag. Unfortunately though, it seems you're hitting the limits of what most (if not all) consumer-grade software can really do for you.
    – Iszi
    Commented May 5, 2016 at 16:40
  • Yes, EnCase is really only for companies that do forensic analysis of drives. For that purpose, the price is relatively cheap. Some of the engagements we used it for earned many hundreds of thousands.
    – Rory Alsop
    Commented May 5, 2016 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .