Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Undelete old NTFS data...

Posted on 2006-04-04
19
Medium Priority
?
640 Views
Last Modified: 2008-01-09
I had some old music that I created on a hard drive.  It's not really that important to me, but I'd like to try and get it back.  It was sitting in my closet for 3 years and I need a drive for a web server dev box, so I used it.

Now I want to try and recover any of it.  The linux install I did on it was small and not much writing occured to the drive besides the initial install.  It is formatted as ext3 now.

Is there any program that is bootable and could try and find old ntfs stuff in there? Is everything that was NTFS definatley gone now that I formatted it as ext3?

Like I said it's not important, but I'd like to try.  Give me anything you got...
0
Comment
Question by:turtletimer
  • 4
  • 3
  • 2
  • +5
16 Comments
 
LVL 97

Accepted Solution

by:
Lee W, MVP earned 296 total points
ID: 16377443
I'd suggest if you're serious about it, try Ontrack's software - www.ontrack.com
0
 
LVL 15

Assisted Solution

by:Tim_Utschig
Tim_Utschig earned 284 total points
ID: 16377576
Knoppix should have ntfsundelete:

    http://man.linux-ntfs.org/ntfsundelete.8.html

Try something like:

    ntfsundelete --scan /dev/hda 2>&1 | tee scan.out

And if it finds any files, maybe try something like:

    ntfsundelete --undelete  --match "*.mp3" --destination /path/to/alternate/storage

Where /path/to/alternate/storage is a place where you have mounted a partition on a different disk.  Your alternate storage must contain a filesystem writable by Linux, so that leaves you with FAT32 if it must be readable in Winders.
0
 
LVL 20

Assisted Solution

by:nedvis
nedvis earned 284 total points
ID: 16377632
  With all due respect to leew and his recommendation ( Ontrack data recovery services) I would say your files - residing on previously NTFS formatted partition- are definitely gone for good. Formatting hard-disk with ext3  destroys all data stored on disk partitions and
undo is  impossible. Your data are destroyed first by patition type conversion ( NTFS --> ext3)  and then overwritten by Linux
operating system, libraries and applications files.
   Ontrack data recovery service guys might have some wizardry hidden in their sleeves but then you have to swallow charges that will occur and I dont think you'd be happy with that.

good luck
nedvis
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 97

Expert Comment

by:Lee W, MVP
ID: 16377666
I disagree.  When I've formatted Extx file systems, I've not seen them do anything destructive to the data.  I'm not saying you'll definitely get the data back, but if it's recoverable without extreme measures, I think ontrack will recover it.
0
 
LVL 20

Expert Comment

by:nedvis
ID: 16377674
ntfsundelete - recovers deleted files from an NTFS volume.
As I understand turtletimer has no NTFS partition(s) anymore.
Am I wrong?
nedvis
0
 
LVL 15

Expert Comment

by:Tim_Utschig
ID: 16377687
> As I understand turtletimer has no NTFS partition(s) anymore.

He more than likely still has NTFS file system structures on his disk.   I am not sure if ntfsundelete requires that partition be otherwise intact, as I've never used it before, but it is feasible to search for these structures and recover the data.
0
 

Author Comment

by:turtletimer
ID: 16378023
The whole partition has been formatted to ext3...

What do you guys think?
0
 
LVL 15

Expert Comment

by:Tim_Utschig
ID: 16378271
The type of file system does not really matter.  None completely overwrite every sector of the disk (and I would guess that none even have an option for doing so).  They only overwrite what they need.
0
 
LVL 15

Expert Comment

by:Tim_Utschig
ID: 16378313
Ok, I had to check the man pages.   If use "-c -c" with mke2fs/mkfs.ext3/etc. it'll destroy all the data, but who does that?
0
 
LVL 2

Assisted Solution

by:ram_einstein
ram_einstein earned 284 total points
ID: 16378657
"Deleting" data isn't a very technically correct term. When you remove files from a magnetic hard disk, the hard disk retains some of the magnetism, which is what is used by most file recovery programs to recover scraps of data. Every file system has a way of indexing the different files on the hard disk so it can protect those sectors of the hard disk from randomly being overwritten; you've lost the index, you just have to manually go through the magnetised sectors to find the headers of the files you want to recover and hopefully some of the file's contents will follow.

What you can recover is also a factor of when the NTFS data was "erased". Usually recovery is possible immediately after deletion. The inital install of your distro might not have overwritted all the sectors on the hard disk with 0s and 1s, like an NTFS or FAT format does. So the data is theoritically recoverable. But with this new filesystem (data recovery software writers don't necessarily support this) and other practical problems of not having windoze, you're also missing out popular software created exclusively for windoze.

It might be too hard to recover the files you deleted imho and you'd probably be wasting time trying to recover small clips of mp3 data and patching it. Think about it- What can data recovery do? It can only recover "scraps" of data since the hard disk hasn't indexed that space and may randomly write to it. It's very unlikely that you'll get even one of your mp3 back intact. Now that's only worth the trouble if you're recovering some really important documents and don't mind if they're filled with junk in the middle and are incomplete- You can always fix that. But you're thinking about recovering music- Would you really like to listen to incomplete, broken, low-quality music? IMHO, you should only recover that music if it means something else to you- ie. you don't just want to listen to it.

Regards,

ram_einstein
0
 
LVL 2

Expert Comment

by:ram_einstein
ID: 16378692
What's with this Ontrack? Have a look at their page (http://www.ontrack.com/easyrecoveryprofessional/) for system requirements:

"
Operating Systems

    * Windows® 98SE & Windows Me
    * Windows® 2000, Windows NT® & Windows XP

File Repair capabilities for:

    * Microsoft Outlook 97, 2000, XP and 2003 (PST & OST)
    * Microsoft Outlook Express 5.0, 5.01, 5.5 and v6.0 (DBX)
    * Microsoft® Word (DOC)
    * Microsoft® Excel (XLS)
    * Microsoft® Access Database (MDB)
    * Microsoft® PowerPoint® (PPT)
    * Zip archive files (ZIP)
"

You don't run windoze and want to recover mp3s. What do you want to achieve with Ontrack?

ntfsundelete isn't any better:

"
Miracles
ntfsundelete cannot perform the impossible.

When a file is deleted the MFT Record is marked as not in use and the bitmap representing the disk usage is updated. If the power isn’t turned off immediately, the free space, where the file used to live, may become overwritten. Worse, the MFT Record may be reused for another file. If this happens it is impossible to tell where the file was on disk.

Even if all the clusters of a file are not in use, there is no guarantee that they haven’t been overwritten by some short-lived file.
"

You don't even have the Master File Table. Besides, I seriously doubt if it can accept an ext3 disk as an argument.


Regards,

ram_einstein
0
 
LVL 50

Assisted Solution

by:dbrunton
dbrunton earned 284 total points
ID: 16380062
These guys

http://www.runtime.org/

have utils for recovering data.  You can try the demo version for free and see if it'll handle your disk and find and NTFS files for you.

No bets though.
0
 
LVL 22

Assisted Solution

by:pjedmond
pjedmond earned 284 total points
ID: 16381388
If you don't try, then you'll never know. With respect to trying to recover data from this type of scenario, I think that for many of the reasons already mentioned, there is a chance that some of the data from the NTFS partition will be recoverable. I don't know how much, as I haven't dealt with quite this set of circumstances before. I have a reasonable degree of experience in 'real' data recovery of commercial servers, and carry out one or two data recovery jobs a month.

Approach that I would use for this drive would be:

1.  Stop using it immediately.
2.  Mount the drive into a test rig which has at least twice the capacity of the drive being recovered.
3.  In this particular case, the software I would use would be Zero Assumption Recovery:

http://www.z-a-recovery.com/

Has an initial scan and image mode in order to give you an idea of what can be recovered.
4.  Run the scan/image/index process. This can take up to 2 days for a 60GB drive on a 2GHz system. It takes a **long** time!
5.  If it shows that the files are recoverable, then you can purchase the licence. The original indexing file can be used in order to save you having to rescan the drive!

Be aware that the software may say that afile.txt is recoverable, and in fact it will recover 3 or 4 versions of the file, which are previous iterations of the file that you've saved (hence me saying that you need at least twice the capacity of spare drive to that being recovered).

Yo can also find that you get files that have been overwritten, but the 'next sector' links on the drive point into a valid file, and hence you'll end up with chamaeleon files that are part of 2 or more files once recovered. You then need to check which files are really what you want.

If ZAR can't recover it, then the only options available to you are the specialist forensic labs...and you will definitely not like the prices £3000+ for a 40GB is not unreasonable, but they are impressive with some of the things that they can do.

HTH:)
0
 
LVL 2

Assisted Solution

by:Sarcast
Sarcast earned 284 total points
ID: 16381665
Why not try a program like GetDataBack ?

The Trial download is free, but will only show you what you can recover, it won't actually recover the data.
(no need to buy, if you can't recover anything I guess.)

http://www.runtime.org/downloads.htm
0
 
LVL 22

Expert Comment

by:pjedmond
ID: 16591203
This is a superb scenario, and technically interesting - I'd welcome information from anyone else as to the exact workings or internal knowledge of these pieces of software. Process carried out was as follows:

1.    Install NTFS partition with Windows 2K professional on old 8GB drive. - Had this lying around.
2.    Delete partition, and replace it with single ext3 / partition and installed puppy linux (Deliberately a small distribution)
3.    Took image using R-Drive Image 3.0.
4.    Drive inserted in test setup. Tried recovery.

I can't get ntfsundelete to work at all in this case, as it is no longer an ntfs file system - I'd welcome anyone else's solution to this, because even after changing the partition table back, it still didn't recognise the partition correctly. I'm wondering if the swap (500MB - deliberately at the end of the drive) is confusing it?

GetDataBack works (but you have to change the partition to be an ntfs one again otherwise it refuses to run on the partition - another write!...but I can get it to work.), but only appears to work if the first block of the file concerned still exists. If the first block of the file is gone, then none of the file is recovered. File recovery from first block seems to continue until a block is missing. Therefore potentially useful.

Zero Assumption Recovery will recover block chains after a missing block, and will also recover old versions of the same file. A little overkill in  that you might end up checking 4-5 copies of a file with the same name in order to find the 'best' one (or most up to date). Had to delete the partition table in order to get this software to behave sensibly. I.e, it takes longer and more work to carry out the recovery, but in my opinion does a more thorough job. Most interestingly, after deleting the partition tables completely, on recovery, it decided that there must have been 2 partitions and did a complete recovery of the puppy linux, and also shed loads of Windows 2K files. Worth noting that the original drive had been in production use for a fair amount of time. Ignoring the puppy linux files, I've got a lot more files recovered with this, but there are loads of 'duplicates', but for some text based files I've got partial recovery where GetDataBack recovered nothing.

Final thoughts are that the individual is trying to recover MP3 files, which they probably only want if they are complete? In which case, GetDataBack is probably the best option if it works at all, followed by ZAR.

HTH:)





0
 
LVL 22

Expert Comment

by:pjedmond
ID: 16591227
If you want the full number of files recovered statistics, you'll have to wait until tomorrow!.....:).....but the above information gives the idea.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
Often times it's very very easy to extend a volume on a Linux instance in AWS, but impossible to shrink it. I wanted to contribute to the experts-exchange community a way of providing a procedure that works on an AWS instance. It can also be used on…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
Suggested Courses
Course of the Month10 days, 14 hours left to enroll

571 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question