Mini How To… How to recover files on a deleted/ corrupt disk


Over Christmas holidays one of the things I did was to replace a failing hard disk in one of my computers with a used one I had spare. The failing hard disk was on an Apple iMac, but that’s another story!

Before I installed it I decided to delete the existing partitions on it using another computers running Ubuntu 12.04 and Gnome 3. At the time this computer had three hard disks installed and dual booted to Windows XP.

Having hooked up the hard disk I booted of a GParted live CD and promptly deleted the partition, shut-down the PC removed the hard disk and then rebooted. All seemed well until I tried to boot into XP where I got missing xyz file error message!

It then dawned on me what had happened. I had wiped the partitions off the wrong hard disk. Whilst I did have a backup, it was a little out of date and whilst normally you can recover deleted partitions with Gparted, if you are using the live CD it will only work if you remain in the original session as the undo information is held on the RAM disk the live CD creates. Once you reboot, your opportunity to recover with Gparted will be lost, as in my case.

To make matters a little more complicated, it was not a Linux disk, but a Windows NTFS formatted disk.

After a bit of searching, I discovered TestDisk which is available in the repositories but also available as a Live CD. More information is available on the testDisk Wiki page http://www.cgsecurity.org/wiki/TestDisk including a Step by Step tutorial.

In my case I booted off the Ubuntu 12.04 partition on the computer and from Terminal ran

sudo apt-get install testdisk

Once installed, from Terminal I entered

sudo testdisk

and the program started.

All I then did was:

  • set my PC type as Intel
  • selected the disk I wanted to recover
  • choose Analyse
  • took the default setting for the NTFS disk format
  • then followed the prompts and the step by step guide mentioned earlier.

Testdisk recovered the partition and 99.9% of the files on the disk.

One of the reasons why this was successful was because I did not use the disk after it was wiped with GParted, had I done so the result would have been less successful.

Next time when deleting partitions on a disk, I’ll double check that it is the right partition by first opening Terminal and entering sudo fdisk -l to list the disk and partition information for each disk.

I’ll also make sure I’m fully awake!

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s