2

The previous situation

I had a problem many years ago with an HDD (with a Windows installation and two usual partitions - the boot one and the NTFS one containing the system and the data) with which I ended up making a disk image thanks to testdisk. This disk image is trivially named image.dd (I was learning and since it was crucial to me to retrieve at some point the data, I followed thoroughly the tutorial to the point where I used the exact name specified in the testdisk turorial). That file is about 250GB and was moved to several disks and devices along the following years. It ended up on a NAS, on an XFS partition. At some point, one of my brother deleted it, because it took too much space.

The current situation

The NAS ended up dying but its unique HDD is not. I am accessing the disk through a USB/SATA dock and I am trying to use photorec to retrieve files. I am surprisingly able to retrieve really old deleted files I am not really interested in but the only file I would really retrieve is the previous image.dd file I previously mentioned. Since there was not a lot of writing on the disk, I am confident that, at least partially, the file is still there (which would explains why the NAS died way before the HDD) since photorec is able to retrieve files from the XFS partition where the files were stored.

This last point was a surprise and I thought the adventure would just stop there, and at least I know that photorec is able to retrieve files from XFS partitions. Especially since after seeing that testdisk does not provide you with the option to find the deleted files on an XFS partition.

Now, what I am concerned about is, even if the file could be retrieved, I will not be able to retrieve the disk image file image.dd because photorec has a precise list of files that can be retrieved. I am guessing that photorec uses the header and/or the extension of files to retrieve them and I do not know what I should expect from a testdisk disk file as a header or if there is any nor if a the weird .dd extension I put could be an advantage or a drawback here.

I know that I could add my own signature/extension to photorec but, since I do not know what to expect from a testdisk disk image file, it seems like a bit of a dead end.

So, my question would be: is there anything to try to retrieve that specific file in this situation?

P.S.: I tried to simplify the situation because it would be even more tedious to follow what happened but I hope I have been clear enough. Let me know in the comments what details I could provide to make it clearer.

P.S.S.: I am running Debian 9.9 on the machine trying to retrieve the data.

  • so... the filesystem is damaged somehow? photorec would likely also recover files from within the image itself (if it's not compressed or encrypted). – frostschutz Jul 5 at 6:39
  • Sorry I forgot the most obvious thing to say. The disk image file I would like to retrieve has been deleted. I changed it in the answer. The XFS filesystem is totally fine, the only thing that died was the NAS itself (one-drive bay small NAS). For now, it is my best chance to retrieve this file but it has been on a different NAS and deleted by one of my brother as well there... I would need to try on that different one if it does not work on the current HDD. – Paradox Jul 5 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.