Index
Subject
: [lug] Digest (5 messages)
From
: lug-owner@lists.ncsu.[redacted]
Date
: Tue, 09 Oct 2012 20:56:24 -0400
The Lug Digest
Volume 1 : Issue 293 : "text" Format
Messages in this Issue:
201210/13 : Re: Using testdisk to "unformat" partition.
". Anand Ramchand Bhatia" <anandr@ncsu.[redacted]>
201210/14 : Re: Using testdisk to "unformat" partition.
NCSU Christian Chapman <cdchapma@ncsu.[redacted]>
201210/16 : Re: Using testdisk to "unformat" partition.
". Anand Ramchand Bhatia" <anandr@ncsu.[redacted]>
201210/17 : Re: Using testdisk to "unformat" partition.
NCSU Christian Chapman <cdchapma@ncsu.[redacted]>
201210/15 : Dinner Tonight - Sammy's at 19:00
Barry Peddycord III <bwpeddyc@ncsu.[redacted]>
----------------------------------------------------------------------
Date: Sun, 7 Oct 2012 02:31:38 -0400
From: ". Anand Ramchand Bhatia" <anandr@ncsu.[redacted]>
To: lug@lists.ncsu.[redacted]
Subject: Re: Using testdisk to "unformat" partition.
Message-ID: <CABvFbRS8Ak3=beRQ+QdeqX42UxmdU1sJyfNKW1nuphDa1ZTnLw@mail.gmail.[redacted]>
Hi folks,
sorry for the mass mail but i need all the input i can get.
here is what testdisk deep analysis gave me.
TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.[redacted]>
http://www.cgsecurity.org
Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
The harddisk (1000 GB / 931 GiB) seems too small! (< 2425 GB / 2259 GiB)
Check the harddisk size: HD jumpers settings, BIOS detection...
The following partitions can't be recovered:
Partition Start End Size in sectors
> FAT32 LBA 66859 157 40 294922 248 27 XXX3837816
FAT16 <32M 110126 61 8 189596 74 44 XXX6686406
Thanks,
Anand Bhatia
Graduate Student, Computer Engineering
North Carolina State University
On Sat, Oct 6, 2012 at 10:43 PM, NCSU Christian Chapman
<cdchapma@ncsu.[redacted]>wrote:
> You may simply have overwritten the partition table. You can use `fdisk'
> or `parted' to re-delineate a partition at the precise boundaries your data
> is. Do you know how the drive was formatted before you did this? If it
> hadn't been `formatted' before this, you might be able to get a hold of a
> brand new identical model, collect info from it, and use that to recreate
> the table.
>
> As far as I know, worst-case using this method will bring you right back
> where you are now.
>
> Hope this gets sorted!
>
> Christian Chapman
> I.am.Christian.Chapman@gmail.[redacted]
> 001064094
> XXX-619-8726
>
>
>
> On Sat, Oct 6, 2012 at 8:54 PM, Michael Wright <mdwrigh2@ncsu.[redacted]> wrote:
>
>> Testdisk seems to be the common suggestion for stuff like this, but I
>> have no experience with it. Ubuntu has a fairly good wiki page on data
>> recovery <https://help.ubuntu.com/community/DataRecovery> that you might
>> want to look at if this doesn't work out. There's also a couple AskUbuntu
>> questions that might be of help (one<http://askubuntu.com/questions/31450/tool-for-recovering-deleted-data-from-a-flash-drive>,
>> two<http://askubuntu.com/questions/106306/how-to-recover-lost-partitions-data>
>> ).
>>
>> Hope this helps!
>>
>> Michael
>>
>> On Sat, Oct 6, 2012 at 8:44 PM, . Anand Ramchand Bhatia <anandr@ncsu.[redacted]>wrote:
>>
>>> Hi folks,
>>>
>>> I've put myself in a bit of trouble here thanks to a hurried aborted
>>> quick format of my external 1TB drive.
>>> I do not have another 1TB HDD to reimage and therefore wish to tread as
>>> carefully as possible.
>>> I am currently trying to see if testdisk (cgsecurity.org) can help me
>>> recover the partition.
>>> Does anyone on the list have experience with using testdisk in such a
>>> scenario.
>>> Quick analyze failed to recover anything reporting that my HDD is
>>> smaller than the expected size.
>>> Deep analysis is in progress.
>>>
>>> Machine details (Windows 7 , 64bit, ext HDD Seagate Freeagent, NTFS(not
>>> 100% sure maybe FAT32 or whatever the default was)).
>>> Any other piece of advise is also welcome.
>>>
>>> Thanks,
>>> Anand Bhatia
>>> Graduate Student, Computer Engineering
>>> North Carolina State University
>>>
>>
>>
>
[Attachment of type text/html removed.]
------------------------------
Date: Sun, 7 Oct 2012 08:49:26 -0400
From: NCSU Christian Chapman <cdchapma@ncsu.[redacted]>
To: lug@lists.ncsu.[redacted]
Subject: Re: Using testdisk to "unformat" partition.
Message-ID: <CAAjUOh8pSY4skV4_rA2Npbq=RD2aaw_cypVFPfZ4ok55xuWOJw@mail.gmail.[redacted]>
Before you formatted, did it only have one partition on it? (Did you have
in the neighborhood of 1000GB of write space?)
If so, it doesn't look like it even found your partition. Have you tried
this TestDisk walkthrough?
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
(Note I am just working on hunches, you may have actually damaged your data
in the format)
--
Christian Chapman
I.am.Christian.Chapman@gmail.[redacted]
001064094
XXX-619-8726
On Sun, Oct 7, 2012 at 2:31 AM, . Anand Ramchand Bhatia <anandr@ncsu.[redacted]>wrote:
> Hi folks,
>
> sorry for the mass mail but i need all the input i can get.
> here is what testdisk deep analysis gave me.
>
> TestDisk 6.14-WIP, Data Recovery Utility, September 2012
> Christophe GRENIER <grenier@cgsecurity.[redacted]>
> http://www.cgsecurity.org
>
> Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
>
> The harddisk (1000 GB / 931 GiB) seems too small! (< 2425 GB / 2259 GiB)
> Check the harddisk size: HD jumpers settings, BIOS detection...
>
> The following partitions can't be recovered:
> Partition Start End Size in sectors
> > FAT32 LBA 66859 157 40 294922 248 27 XXX3837816
> FAT16 <32M 110126 61 8 189596 74 44 XXX6686406
>
> Thanks,
> Anand Bhatia
> Graduate Student, Computer Engineering
> North Carolina State University
>
>
> On Sat, Oct 6, 2012 at 10:43 PM, NCSU Christian Chapman <cdchapma@ncsu.[redacted]
> > wrote:
>
>> You may simply have overwritten the partition table. You can use `fdisk'
>> or `parted' to re-delineate a partition at the precise boundaries your data
>> is. Do you know how the drive was formatted before you did this? If it
>> hadn't been `formatted' before this, you might be able to get a hold of a
>> brand new identical model, collect info from it, and use that to recreate
>> the table.
>>
>> As far as I know, worst-case using this method will bring you right back
>> where you are now.
>>
>> Hope this gets sorted!
>>
>> Christian Chapman
>> I.am.Christian.Chapman@gmail.[redacted]
>> 001064094
>> XXX-619-8726
>>
>>
>>
>> On Sat, Oct 6, 2012 at 8:54 PM, Michael Wright <mdwrigh2@ncsu.[redacted]> wrote:
>>
>>> Testdisk seems to be the common suggestion for stuff like this, but I
>>> have no experience with it. Ubuntu has a fairly good wiki page on data
>>> recovery <https://help.ubuntu.com/community/DataRecovery> that you
>>> might want to look at if this doesn't work out. There's also a couple
>>> AskUbuntu questions that might be of help (one<http://askubuntu.com/questions/31450/tool-for-recovering-deleted-data-from-a-flash-drive>,
>>> two<http://askubuntu.com/questions/106306/how-to-recover-lost-partitions-data>
>>> ).
>>>
>>> Hope this helps!
>>>
>>> Michael
>>>
>>> On Sat, Oct 6, 2012 at 8:44 PM, . Anand Ramchand Bhatia <anandr@ncsu.[redacted]
>>> > wrote:
>>>
>>>> Hi folks,
>>>>
>>>> I've put myself in a bit of trouble here thanks to a hurried aborted
>>>> quick format of my external 1TB drive.
>>>> I do not have another 1TB HDD to reimage and therefore wish to tread as
>>>> carefully as possible.
>>>> I am currently trying to see if testdisk (cgsecurity.org) can help me
>>>> recover the partition.
>>>> Does anyone on the list have experience with using testdisk in such a
>>>> scenario.
>>>> Quick analyze failed to recover anything reporting that my HDD is
>>>> smaller than the expected size.
>>>> Deep analysis is in progress.
>>>>
>>>> Machine details (Windows 7 , 64bit, ext HDD Seagate Freeagent, NTFS(not
>>>> 100% sure maybe FAT32 or whatever the default was)).
>>>> Any other piece of advise is also welcome.
>>>>
>>>> Thanks,
>>>> Anand Bhatia
>>>> Graduate Student, Computer Engineering
>>>> North Carolina State University
>>>>
>>>
>>>
>>
>
[Attachment of type text/html removed.]
------------------------------
Date: Tue, 9 Oct 2012 20:46:30 -0400
From: ". Anand Ramchand Bhatia" <anandr@ncsu.[redacted]>
To: lug@lists.ncsu.[redacted]
Subject: Re: Using testdisk to "unformat" partition.
Message-ID: <CABvFbRSH0CaSktWhZ6tjAHTpNwzqYjADneuZ5=yje5=-_V3gCA@mail.gmail.[redacted]>
Just for closure and for future use. Testdisk was unable to recover the
NTFS partitions on my external hard drive.
In fact, I found the interface slightly unwieldy. I would recommend
reimaging the faulty drive before experimenting with testdisk as it can be
dangerous if not used correctly.
What finally helped me was GetDataBack for NTFS, which not only recovered
the data but was able to retrieve the complete partition details.
The recovery was complete in less than a day once I started analysis with
the tool.
Hope this helps.
Thanks,
Anand Bhatia
Graduate Student, Computer Engineering
North Carolina State University
On Sun, Oct 7, 2012 at 8:49 AM, NCSU Christian Chapman <cdchapma@ncsu.[redacted]>wrote:
> Before you formatted, did it only have one partition on it? (Did you have
> in the neighborhood of 1000GB of write space?)
>
> If so, it doesn't look like it even found your partition. Have you tried
> this TestDisk walkthrough?
> http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
>
> (Note I am just working on hunches, you may have actually damaged your
> data in the format)
>
> --
> Christian Chapman
> I.am.Christian.Chapman@gmail.[redacted]
> 001064094
> XXX-619-8726
>
> On Sun, Oct 7, 2012 at 2:31 AM, . Anand Ramchand Bhatia <anandr@ncsu.[redacted]>wrote:
>
>> Hi folks,
>>
>> sorry for the mass mail but i need all the input i can get.
>> here is what testdisk deep analysis gave me.
>>
>> TestDisk 6.14-WIP, Data Recovery Utility, September 2012
>> Christophe GRENIER <grenier@cgsecurity.[redacted]>
>> http://www.cgsecurity.org
>>
>> Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
>>
>> The harddisk (1000 GB / 931 GiB) seems too small! (< 2425 GB / 2259 GiB)
>> Check the harddisk size: HD jumpers settings, BIOS detection...
>>
>> The following partitions can't be recovered:
>> Partition Start End Size in sectors
>> > FAT32 LBA 66859 157 40 294922 248 27 XXX3837816
>> FAT16 <32M 110126 61 8 189596 74 44 XXX6686406
>>
>> Thanks,
>> Anand Bhatia
>> Graduate Student, Computer Engineering
>> North Carolina State University
>>
>>
>> On Sat, Oct 6, 2012 at 10:43 PM, NCSU Christian Chapman <
>> cdchapma@ncsu.[redacted]> wrote:
>>
>>> You may simply have overwritten the partition table. You can use `fdisk'
>>> or `parted' to re-delineate a partition at the precise boundaries your data
>>> is. Do you know how the drive was formatted before you did this? If it
>>> hadn't been `formatted' before this, you might be able to get a hold of a
>>> brand new identical model, collect info from it, and use that to recreate
>>> the table.
>>>
>>> As far as I know, worst-case using this method will bring you right back
>>> where you are now.
>>>
>>> Hope this gets sorted!
>>>
>>> Christian Chapman
>>> I.am.Christian.Chapman@gmail.[redacted]
>>> 001064094
>>> XXX-619-8726
>>>
>>>
>>>
>>> On Sat, Oct 6, 2012 at 8:54 PM, Michael Wright <mdwrigh2@ncsu.[redacted]>wrote:
>>>
>>>> Testdisk seems to be the common suggestion for stuff like this, but I
>>>> have no experience with it. Ubuntu has a fairly good wiki page on data
>>>> recovery <https://help.ubuntu.com/community/DataRecovery> that you
>>>> might want to look at if this doesn't work out. There's also a couple
>>>> AskUbuntu questions that might be of help (one<http://askubuntu.com/questions/31450/tool-for-recovering-deleted-data-from-a-flash-drive>,
>>>> two<http://askubuntu.com/questions/106306/how-to-recover-lost-partitions-data>
>>>> ).
>>>>
>>>> Hope this helps!
>>>>
>>>> Michael
>>>>
>>>> On Sat, Oct 6, 2012 at 8:44 PM, . Anand Ramchand Bhatia <
>>>> anandr@ncsu.[redacted]> wrote:
>>>>
>>>>> Hi folks,
>>>>>
>>>>> I've put myself in a bit of trouble here thanks to a hurried aborted
>>>>> quick format of my external 1TB drive.
>>>>> I do not have another 1TB HDD to reimage and therefore wish to tread
>>>>> as carefully as possible.
>>>>> I am currently trying to see if testdisk (cgsecurity.org) can help me
>>>>> recover the partition.
>>>>> Does anyone on the list have experience with using testdisk in such a
>>>>> scenario.
>>>>> Quick analyze failed to recover anything reporting that my HDD is
>>>>> smaller than the expected size.
>>>>> Deep analysis is in progress.
>>>>>
>>>>> Machine details (Windows 7 , 64bit, ext HDD Seagate Freeagent,
>>>>> NTFS(not 100% sure maybe FAT32 or whatever the default was)).
>>>>> Any other piece of advise is also welcome.
>>>>>
>>>>> Thanks,
>>>>> Anand Bhatia
>>>>> Graduate Student, Computer Engineering
>>>>> North Carolina State University
>>>>>
>>>>
>>>>
>>>
>>
[Attachment of type text/html removed.]
------------------------------
Date: Tue, 9 Oct 2012 20:56:07 -0400
From: NCSU Christian Chapman <cdchapma@ncsu.[redacted]>
To: lug@lists.ncsu.[redacted]
Subject: Re: Using testdisk to "unformat" partition.
Message-ID: <CAAjUOh8_zF7bQPzN0JiD=pXNf+F+_w-xLChTi11LLVcM4HBhgQ@mail.gmail.[redacted]>
Glad this got sorted, GetDataBack is legendary. Thanks for the follow up
and sorry we couldn't be of more help!
--
Christian Chapman
I.am.Christian.Chapman@ncsu.[redacted]
001064094
XXX-619-8726
On Tue, Oct 9, 2012 at 8:46 PM, . Anand Ramchand Bhatia <anandr@ncsu.[redacted]>wrote:
> Just for closure and for future use. Testdisk was unable to recover the
> NTFS partitions on my external hard drive.
> In fact, I found the interface slightly unwieldy. I would recommend
> reimaging the faulty drive before experimenting with testdisk as it can be
> dangerous if not used correctly.
> What finally helped me was GetDataBack for NTFS, which not only recovered
> the data but was able to retrieve the complete partition details.
> The recovery was complete in less than a day once I started analysis with
> the tool.
> Hope this helps.
>
>
> Thanks,
> Anand Bhatia
> Graduate Student, Computer Engineering
> North Carolina State University
>
>
> On Sun, Oct 7, 2012 at 8:49 AM, NCSU Christian Chapman <cdchapma@ncsu.[redacted]>wrote:
>
>> Before you formatted, did it only have one partition on it? (Did you
>> have in the neighborhood of 1000GB of write space?)
>>
>> If so, it doesn't look like it even found your partition. Have you tried
>> this TestDisk walkthrough?
>> http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
>>
>> (Note I am just working on hunches, you may have actually damaged your
>> data in the format)
>>
>> --
>> Christian Chapman
>> I.am.Christian.Chapman@gmail.[redacted]
>> 001064094
>> XXX-619-8726
>>
>> On Sun, Oct 7, 2012 at 2:31 AM, . Anand Ramchand Bhatia <anandr@ncsu.[redacted]>wrote:
>>
>>> Hi folks,
>>>
>>> sorry for the mass mail but i need all the input i can get.
>>> here is what testdisk deep analysis gave me.
>>>
>>> TestDisk 6.14-WIP, Data Recovery Utility, September 2012
>>> Christophe GRENIER <grenier@cgsecurity.[redacted]>
>>> http://www.cgsecurity.org
>>>
>>> Disk /dev/sdc - 1000 GB / 931 GiB - CHS 121601 255 63
>>>
>>> The harddisk (1000 GB / 931 GiB) seems too small! (< 2425 GB / 2259 GiB)
>>> Check the harddisk size: HD jumpers settings, BIOS detection...
>>>
>>> The following partitions can't be recovered:
>>> Partition Start End Size in sectors
>>> > FAT32 LBA 66859 157 40 294922 248 27 XXX3837816
>>> FAT16 <32M 110126 61 8 189596 74 44 XXX6686406
>>>
>>> Thanks,
>>> Anand Bhatia
>>> Graduate Student, Computer Engineering
>>> North Carolina State University
>>>
>>>
>>> On Sat, Oct 6, 2012 at 10:43 PM, NCSU Christian Chapman <
>>> cdchapma@ncsu.[redacted]> wrote:
>>>
>>>> You may simply have overwritten the partition table. You can use
>>>> `fdisk' or `parted' to re-delineate a partition at the precise boundaries
>>>> your data is. Do you know how the drive was formatted before you did this?
>>>> If it hadn't been `formatted' before this, you might be able to get a hold
>>>> of a brand new identical model, collect info from it, and use that to
>>>> recreate the table.
>>>>
>>>> As far as I know, worst-case using this method will bring you right
>>>> back where you are now.
>>>>
>>>> Hope this gets sorted!
>>>>
>>>> Christian Chapman
>>>> I.am.Christian.Chapman@gmail.[redacted]
>>>> 001064094
>>>> XXX-619-8726
>>>>
>>>>
>>>>
>>>> On Sat, Oct 6, 2012 at 8:54 PM, Michael Wright <mdwrigh2@ncsu.[redacted]>wrote:
>>>>
>>>>> Testdisk seems to be the common suggestion for stuff like this, but I
>>>>> have no experience with it. Ubuntu has a fairly good wiki page on
>>>>> data recovery <https://help.ubuntu.com/community/DataRecovery> that
>>>>> you might want to look at if this doesn't work out. There's also a couple
>>>>> AskUbuntu questions that might be of help (one<http://askubuntu.com/questions/31450/tool-for-recovering-deleted-data-from-a-flash-drive>,
>>>>> two<http://askubuntu.com/questions/106306/how-to-recover-lost-partitions-data>
>>>>> ).
>>>>>
>>>>> Hope this helps!
>>>>>
>>>>> Michael
>>>>>
>>>>> On Sat, Oct 6, 2012 at 8:44 PM, . Anand Ramchand Bhatia <
>>>>> anandr@ncsu.[redacted]> wrote:
>>>>>
>>>>>> Hi folks,
>>>>>>
>>>>>> I've put myself in a bit of trouble here thanks to a hurried aborted
>>>>>> quick format of my external 1TB drive.
>>>>>> I do not have another 1TB HDD to reimage and therefore wish to tread
>>>>>> as carefully as possible.
>>>>>> I am currently trying to see if testdisk (cgsecurity.org) can help
>>>>>> me recover the partition.
>>>>>> Does anyone on the list have experience with using testdisk in such a
>>>>>> scenario.
>>>>>> Quick analyze failed to recover anything reporting that my HDD is
>>>>>> smaller than the expected size.
>>>>>> Deep analysis is in progress.
>>>>>>
>>>>>> Machine details (Windows 7 , 64bit, ext HDD Seagate Freeagent,
>>>>>> NTFS(not 100% sure maybe FAT32 or whatever the default was)).
>>>>>> Any other piece of advise is also welcome.
>>>>>>
>>>>>> Thanks,
>>>>>> Anand Bhatia
>>>>>> Graduate Student, Computer Engineering
>>>>>> North Carolina State University
>>>>>>
>>>>>
>>>>>
>>>>
>>>
>
[Attachment of type text/html removed.]
------------------------------
Date: Tue, 09 Oct 2012 11:30:06 -0400
From: Barry Peddycord III <bwpeddyc@ncsu.[redacted]>
To: lug@lists.ncsu.[redacted]
Subject: Dinner Tonight - Sammy's at 19:00
Message-ID: <507442FE.40109@ncsu.[redacted]>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hai Lugz:
Tonight at 19:00 (aka 7 PM) we will have dinner at Sammy's in Mission
Valley. Join us for wings and Linux-related nonsense.
Signed,
Barry
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQEcBAEBAgAGBQJQdEL5AAoJEHuunagdgjYN18AIALIGYExCnb7m/UjLH7wxVK1y
IUU1bFsJJVtPY8typmq0eei8HzpuNGxewnodlvBJDpEHuZ+hu8/bUZMCI+N6RnfP
cwHdUloARN1mcQVZXTVQ/VPHW2VD+yxtQcWmD+5qoLr/kERxpqtdjX4GCgW/SKUg
/CHDsKVg5E1Id3oPrmakqxI9IVnOjrtV+8jBCP5z8WuDnjgAdqwQHw8YOH1+G/L8
CSyQTsiunYQaQjuI0GaM8roS0zTfFcv3bUg3L7yDuR9xfzVA2PyMDvrkP5HMhTxO
Jq7oxRnK/vuAoC4dWOObhUrB9215DFXb3srjDyzF2FaGm47yP6+XryMTXnX/Gps=
=WG/2
-----END PGP SIGNATURE-----
------------------------------
End of [lug] Digest (5 messages)
**********