0

My disk, which was previously ext4 has been formatted and Windows has been installed. I want to recover my previous files (family photos, ..) and I tried everything I could find on the internet.

I first cloned an image of the disk to work on it, and I've tested Testdisk, but I couldn't do anything with it. In fact, when I analyze the disk I can find the partition (multiple instances, I don't know why) but when I list the files it doesn't find anything and give the message error: "can't open filesystem. Filesystem seems damaged". I also tried to look for superblocks but still the same error.

e2fsck tell's me : "the superblock could not be read or does not describe a correct ext2 filesystem".

  • I don't think that is possible. I had kinda similar problems deleting some system files with rm command on ext4 partition and I was not able to get them back and I ended up having to reinstall my system. Your problem is probably worse, since you formatted your partition and write data over your previous data by installing Windows over them. – Alko Jul 29 '13 at 12:10
  • 1
    Try photorec or recoverjpeg for the family photos. It will find the ones that are not overwritten and not fragmented. Make backups in the future. – frostschutz Jul 29 '13 at 19:33
1

It may be possible to use specialized recovery tools which search for data signatures throughout the entire disk; one possible list of such tools might be How can I recover photo files from a CF memory card with a corrupt filesystem? on Photo.SE. The fact that the question as asked relates to CompactFlash memory cards makes little difference in terms of logical data recovery.

Your problem is much exacerbated because not only have you possibly repartitioned and certainly reformatted the drive (which probably wouldn't be so bad because it'd likely leave most of the file system structures intact, since they are placed in different locations on the disk and also have some degree of redundancy), but also copied loads of data onto it by installing Windows, data which can be placed at arbitrary locations. Recovering data from a formatted drive is non-trivial but doable; recovering data from a modern, overwritten drive is nigh impossible. Your situation with some areas of the drive overwritten sits somewhere in between those two.

A few references might be this 2007 OnTrack response about recovery of overwritten data, Wikipedia naming at least two 2006 sources saying one overwrite pass makes data unrecoverable, and ForensicsWiki referencing a 2008 paper with the purpose of settling the misconceptions around overwritten data recovery beliefs, which "has demonstrated that correctly wiped data cannot reasonably be retrieved even if it is of a small size or found only over small parts of the hard drive". The only real counterexample seems to be an article in Wired about data being recovered after being overwritten in the Bradley Manning case, but even if that was recovered from overwritten disk sectors (there are many other ways to gain access to such small pieces of data as are mentioned in the article) it still seems to only be a few specific files, not wholesale data recovery.

Frankly, in this case, I think you are out of luck. It might be possible to restore a few files here and there, but that will be about the extent of your success.

It may be worth your while to contact a few data recovery firms and ask whether they might be able to help. They might have access to specialized software which can do a better job at data recovery because you can explain what has happened to your disk, but it will be very expensive. Expect any such recovery efforts to cost four- to five-digit dollar amounts if you go that route, and of course there's still no guarantee of success.

Other than that, you'll probably have to think about what copies may be available from elsewhere: family members, uploaded to photo-sharing or social networking sites, etc etc.

  • Thank you for your answers. But Testdisk lists some ext4 (partitions ??) and tells that it corresponds to a superblock, but tells that the filesystem can't be mount. Even with that, it is not possible ? dspider.picturepush.com/album/323069/p-Picture-Box.html – Spider Jul 29 '13 at 13:22
  • @Spider Since you've written over quite a lot of the partition, it's highly unlikely that enough data remains to recover any part of the directory tree. Testdisk presumably detects an ext4 filesystem because some of the copies of the superblock remain, but that's not sufficient. You can probably recover some individual files — only the ones that happen to be outside the overwritten areas, of course. – Gilles Jul 29 '13 at 23:24
  • @Gilles Follow-up question posted as answer. Feel free to flag this comment as obsolete once seen. – a CVn Jul 30 '13 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.