0

Have ~300Gig of data on a usb . All data came from OSX and trying to move them onto a windows machine. I was able to see the files on my linux (ubuntu 16.04) machine , but after sticking the usb into a windows machine i can no longer even see the files on my linux machine (rather worried it may have auto formatted the usb or something).

Looking for any advice on getting access to these files.

The output of fdisk -l

Disk /dev/sdc: 298,1 GiB, 320072933376 bytes, 625142448 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 77347EEF-C6E9-4EFF-ABF1-1A3F1BF8E77D

Device     Start    End Sectors  Size Type
/dev/sdc1     34 262177  262144  128M Microsoft reserved

output of lsblk

NAME   MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda      8:0    0 111,8G  0 disk 
├─sda1   8:1    0  95,9G  0 part /
├─sda2   8:2    0     1K  0 part 
└─sda5   8:5    0  15,9G  0 part [SWAP]
sdb      8:16   0 931,5G  0 disk 
├─sdb1   8:17   0 810,4G  0 part /media/brian/f4ea7fea-a69d-4079-9922-
68446938cef4
└─sdb2   8:18   0 121,1G  0 part /media/brian/5F697898270A5A4C
sdc      8:32   0 298,1G  0 disk 
└─sdc1   8:33   0   128M  0 part 
sr0     11:0    1  1024M  0 rom  

The usb in question is located in sdc

1

The partition table in your USB device looks wrong. It says you have a single partition 128 megabytes in size, and nothing else.

As things stand, the disk is unreadable and you need some recovery tool to attempt to read back the data. Is the original MacOS drive still available?

What probably happened is that you had a USB formatted in some filesystem that Windows did not recognize, and which lead it to try and "fix" things making it a GPT unit.

On a hunch, I'd try creating (but NOT formatting) a new partition entry starting immediately after sdc1, and occupying the remaining 299Gb. Then try mounting it read only in Linux. Do not attempt to write anything (except the first sector with the partition table) on the disk.

If you had a single partition, overwriting the first 128M of it is almost sure to have corrupted a sizeable amount of information, and the files might well be unrecoverable except piecemeal. This greatly depends on what FS was on the drive though. I wouldn't attempt a recovery myself, and would rather try some professional recovery service.

How to proceed

First recourse is try and get back the original files from the MacOS.

If this is not possible and the 300GB drive is the only place the files might still exist, then consider purchasing/obtaining another drive of similar or larger capacity, and do a sector by sector copy of the disk on another drive. Then do everything on the copy, not on the original.

Then I'd try with an automated recovery tool (here a tutorial).

If the disk is still lost, piecemeal recovery can work. The above tutorial, at the end, presents a "more unfortunate case" with this happening. In this scenario you're not going to recover everything, but you might recover enough.

  • What would you recommend as the best recovery tool for such an issue ? – razeal113 Dec 10 '17 at 19:41
0

You might try TestDisk. If it cannot detect a valid-looking partition on the USB device (i.e. one with an approximate size of ~300 Gig), then definitely stop messing with it and send it to the professionals if the data has significant value to you.

http://www.cgsecurity.org/wiki/TestDisk

If TestDisk indicates it can recover a valid partition and see correct-looking files within it, and the data has less value than the data recovery professionals would bill you for, only then, after careful consideration, you might allow TestDisk to actually apply the correction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.