External Hard drive ressurection

Recovered an external drive using TestDisk and PhotoRec today.

http://www.cgsecurity.org/wiki/TestDisk

Was brought a 750GB external drive that was not recognizing the filesystem when attached to any machine(Windows, Mac, Linux).  As there was some data that was important and not backed up anywhere else, first move is to try and retrieve as much data as possible.  Unfortunately cloning a drive of this size was an issue due to the fact that I had nowhere quickly to host a 750GB image. As it turned out this drive was storing 650GB of data.

Step 1. Recovery

I was able to use Photorec (http://www.cgsecurity.org/wiki/PhotoRec) to recover about 90GB of music, but was coming up short on other important files such as pictures.

Step 2. Rebuild Partitions.

I recovered music from what was listed as an EFI partition.  A deep scan found 2 deleted HFS partitions.  I was a little unsure on the structure of the drive at this point.  TestDisk was not able to show me the files because the filesystem support was not there.  I took a chance on writing the first HFS partition as primary, as I assumed the end users were casually using this drive and unaware of the filesystem or different partitioning needs.  It was successful and upon reboot the drive recognized and was labled correctly.

There’s a little bit of a learning curve with TestDisk and Photorec but in the end it was the right tool for the job.

In the end I would have preferred to clone the drive and work from an image but I don’t argue with results, I was aware of the risk but felt I chose the right actions.

Screenshot from 2015-05-09 21:16:42

 

 

This entry was posted in Tech. Bookmark the permalink.