TestDisk & PhotoRec

Miscellaneous tools
Message
Author
aragon
Posts: 1698
Joined: Mon 15 Oct 2007, 12:18
Location: Germany

#16 Post by aragon »

jemimah wrote:The filesize of testdisk and photorec is much smaller if you build from source rather than using the static binaries. I just built it on Puppeee with no problems.
thanks for the info, will try to compile on std-4.31.

aragon

disciple
Posts: 6984
Joined: Sun 21 May 2006, 01:46
Location: Auckland, New Zealand

#17 Post by disciple »

Hi Aragon,
I didn't realise you were maintaining a package. Thanks for that.

It would be good if you could edit the first post again. My earlier clarification is now out-of-date:

Photorec still tries to recover all the files on a partition by looking for chunks of data ("signature" based file recovery).
But as well as recovering partitions, Testdisk can now recover specific files from FAT/NTFS/ext2 partitions by looking for deleted files in the FAT or whatever the filesystem index is called. See:
http://www.cgsecurity.org/wiki/TestDisk ... e_for_NTFS
http://www.cgsecurity.org/wiki/TestDisk ... le_for_FAT
http://www.cgsecurity.org/wiki/TestDisk ... e_for_ext2

So usually you would now want to try undeleting with testdisk before using photorec.
Do you know a good gtkdialog program? Please post a link here

Classic Puppy quotes

ROOT FOREVER
GTK2 FOREVER

User avatar
chrome307
Posts: 708
Joined: Thu 15 Jan 2009, 11:00

#18 Post by chrome307 »

Hi Aragon

Are you still maintaining this useful application?

If so, there is a Beta version available:

Test Disk 6.12-WIP ( October 2010 )

There are versions available on their website:
http://www.cgsecurity.org/wiki/TestDisk_Download

Linux, kernel 2.6.x i386/x86_64
Linux, kernel 2.4.x i386/x86_64

I'm using Puppy Linux 4.31, so kernel 2.6x would be great.

aragon
Posts: 1698
Joined: Mon 15 Oct 2007, 12:18
Location: Germany

#19 Post by aragon »

chrome307 wrote:Hi Aragon

Are you still maintaining this useful application?

If so, there is a Beta version available:

Test Disk 6.12-WIP ( October 2010 )

There are versions available on their website:

http://www.cgsecurity.org/wiki/TestDisk_Download

Linux, kernel 2.6.x i386/x86_64
Linux, kernel 2.4.x i386/x86_64

I'm using Puppy Linux 4.31, so kernel 2.6x would be great.
Hi Chrome307,

yes i saw that but won't make a pet of the beta. i will do, when 6.12 is stable.

if you want to test the 6.12 beta, it's not diffcult. download the precompiled package and extract it. there should be a subdir called linux, where you will find the precomiled binaries

- photorec_static
- testdisk_static

if you copy those to your PATH, you're done.

aragon

User avatar
chrome307
Posts: 708
Joined: Thu 15 Jan 2009, 11:00

#20 Post by chrome307 »

OK, thanks for the instructions on how to use the new beta version.

I've used this application twice on HDD's and it's saved my life, once when I had accidentally formatted my HDD to use it for a frugal install for Puppy. It just 'works' :)

Regards

User avatar
jemimah
Posts: 4307
Joined: Wed 26 Aug 2009, 19:56
Location: Tampa, FL
Contact:

#21 Post by jemimah »

The extundelete utility is also worth mention. Testdisk can only recover files from EXT2, for EXT3 and EXT4, you need extundelete.
http://extundelete.sourceforge.net/

(Yes I found this out the hard way). ;)

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#22 Post by Flash »

aragon wrote:...if you want to test the 6.12 beta, it's not diffcult. download the precompiled package and extract it. there should be a subdir called linux, where you will find the precompiled binaries

- photorec_static
- testdisk_static

if you copy those to your PATH, you're done.

aragon
I'm not sure I understand this PATH stuff. :oops: I'm guessing that if I copy the extracted files into /bin, they will work from a console window that I open by using the ` key in the directory where I want to use them. Do I have that correct?

Edit: Yes, that seems to work. I extracted only the photorec_static and put it in /bin. Then I opened a console and entered photorec --help to confirm that photorec was "installed."

So far I tried photorec on a flash memory stick that got corrupted about a year ago. Photorec seems to have recovered every single file that was on that stick! Amazing! I feel like I got an early Christmas present. :D

The only thing is, I didn't open the console where I ran photorec from in the partition where I wanted photorec to store the recovered files, so Puppy's RAM got filled up. (I run Puppy from multisession DVD, so it's always in RAM.) That's ok.

aragon
Posts: 1698
Joined: Mon 15 Oct 2007, 12:18
Location: Germany

#23 Post by aragon »

Hi Flash,

Yes and no (allways that answer, isn't it?).

PATH is the variable thats holds the dirs, where puppy looks for executables. You could check that with

echo $PATH

from within a terminal.

I also see that my explanation was a little short for the case that you've allready installed photorec before.

You've mentioned. That you've copied photorec_static to /bin and than tested with photorec --help if it's installedm
That could not work correct, because the bin is photorec_static if you haven't renamed it. You should check that.
To be sure you call the correct one you might rename the one you copied to /bin to maybe photorec_new and than check with photorec_new --version.

Hope that helps.

Aragon

User avatar
Flash
Official Dog Handler
Posts: 13071
Joined: Wed 04 May 2005, 16:04
Location: Arizona USA

#24 Post by Flash »

Thanks for the answer, aragon. Turns out I couldn't have been more wrong about everything, as usual. :lol: The reason photorec worked is that it was apparently included in the testdisk .pet I had already installed before I put the photorec_static file in /bin.

If I understand you right, changing the name of the photorec_static file to photorec should make it run when I enter photorec from a console?

By the way, here's the result of entering echo $PATH from a console I opened by clicking the desktop icon:
# echo $PATH
/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin:/usr/X11R7/bin:/root/my-applications/bin:/opt/samba/bin
#
Am I right in guessing that those are all the places the console looks when trying to find a command I enter?

aragon
Posts: 1698
Joined: Mon 15 Oct 2007, 12:18
Location: Germany

#25 Post by aragon »

Flash,

Once again yesno...

Your understanding of PATH is correct.

You run a prog with the name you gave it. So if you run photorec you will allways run the prog that' called photorec (which should be the original from the pet i guess). The step i told you with renaming the new copied (the photorec_static) to photorec_new is mandantory, just to be sure you're running the correct (new one) if you wanted to. So you would call the 'old' one with photorec and the new one with photorec_new.

aragon

User avatar
edoc
Posts: 4729
Joined: Sun 07 Aug 2005, 20:16
Location: Southeast Georgia, USA
Contact:

#26 Post by edoc »

I was trying to use dparted from a USB boot on a netbook with an existing MS version of windows called "7" so that I could resize the partitions and add one or two for a Frugal install of Puppy Linux - Fluppy 011.

Every app I tried, except for gparted, is able to see the NTSF partitions sda1 and sda2 - so I tried gparted from Console and this was the result:
#gparted
----------------
libparted: 2.3
----------------

/dev/sda contains GPT signatures, indicating it has a GPT table. However, it does not have a valid fake msdos partition table, as it should. Perhaps it was corrupted by a program that does not understand GPT partition tables. Or perhaps you deleted the GPT table, and are now using an msdos partition table. Is this a GPT partition table?
So then, at Jemimah's suggestion, I tried Testdisk to see if the partition table was damaged and could be repaired.

Testdisk found the following:
D HPFS-NTFS 0 1 1 7147 254 63 114832557 [System Reserved]
D HPFS-NTFS 0 32 33 12 223 19 204800 [System Reserved]
D HPFS-NTFS 12 223 20 19457 21 20 312371200 [System Reserved]
D HPFS-NTFS 510 0 1 5609 254 63 81931500 [System Reserved]
D HPFS-NTFS 5610 0 1 19456 254 63 222452055 [System Reserved]
D FAT32 LBA 7148 0 1 13428 254 14 100904216 [TEST]
D FAT32 LBA 13429 0 1 19456 254 43 96839800 [DOS]

If I make the first line anything but "D" then the rest show up in RED as "Structure Bad".

If I leave the first line as "D" I can change lines 2 and 3 to "P" then the last four must also be "D".

Would making those changes be likely to destroy the MS-win.7 install and force me to reinstall MS-win.7 or might it clear up the problems and then be able to use gparted to manage the partitions and get Fluppy 011 installed as Frugal, please?

Thanks!
[b]Thanks! David[/b]
[i]Home page: [/i][url]http://nevils-station.com[/url]
[i]Don't google[/i] [b]Search![/b] [url]http://duckduckgo.com[/url]
TahrPup64 & Lighthouse64-b602 & JL64-603

User avatar
edoc
Posts: 4729
Joined: Sun 07 Aug 2005, 20:16
Location: Southeast Georgia, USA
Contact:

#27 Post by edoc »

I just tried EFI GPT in Testdisk and got this:
TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 160 GB / 149 GiB - CHS 19457 255 63
Partition Start End Size in sectors
P EFI System 40 409639 409600 [EFI]
P MS Data 1935760 1941933 6174 [Boot]
P MS Data 1941952 1948125 6174 [Boot]
P MS Data 7049011 7069749 20739 [NO NAME]
P MS Data 24826744 24832917 6174 [Boot]
P MS Data 25031536 25037709 6174 [Boot]
P MS Data 26508043 26528781 20739 [NO NAME]
P MS Data 29633384 29639557 6174 [Boot]
P MS Data 90124649 172056148 81931500
P MS Data 215736885 312576684 96839800 [DOS]


Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
P=Primary D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
Enter: to continue
FAT32, 209 MB / 200 MiB
WDYT?
[b]Thanks! David[/b]
[i]Home page: [/i][url]http://nevils-station.com[/url]
[i]Don't google[/i] [b]Search![/b] [url]http://duckduckgo.com[/url]
TahrPup64 & Lighthouse64-b602 & JL64-603

User avatar
edoc
Posts: 4729
Joined: Sun 07 Aug 2005, 20:16
Location: Southeast Georgia, USA
Contact:

#28 Post by edoc »

QUESTION ...

If I am booted in Fluppy 011 via a USB stick and I make changes via Testdisk to the MBR, or anything else about the file structure to fix the aforementioned problem(s), how do I save it and where?

Savefile only goes to the USB stick - I need to write to the HDD - but where (based on what I have posted previously), please?

This seems to be a Catch 22.
[b]Thanks! David[/b]
[i]Home page: [/i][url]http://nevils-station.com[/url]
[i]Don't google[/i] [b]Search![/b] [url]http://duckduckgo.com[/url]
TahrPup64 & Lighthouse64-b602 & JL64-603

jamesbond
Posts: 3433
Joined: Mon 26 Feb 2007, 05:02
Location: The Blue Marble

#29 Post by jamesbond »

Hi edoc,

I'm not an expert on this but because nobody replies to you, I'll try to make some sense out of it.

1. Your machine is a netbook, isn't it? And the version of Windows 7 that you have is 32-bit, isn't it? 32-bit Windows doesn't support GPT partition tables according to Wikipedia - so Testdisk output of GPT partition tables can be ignored.

2. Testdisk output of the normal MBR partition table also doesn't look correct - how come all entries are "D" (=deleted)?

3. Does your laptop runs some kind of encryption software? (e.g. BitLocker, that comes with Windows, or other full-disk encryption like Truecrypt or anything?). Sorry - I can't help you how to check this - I don't run the software myself, but your problem can be caused by these types of software.

4. Can you give me output of "fdisk -l /dev/sda"?
5. Can you do this and upload the file to here?

Code: Select all

dd if=/dev/sda of=/root/sectors bs=512 count=63
The output file will be in /root and the name of the file is "sectors", upload it to here please. (This command will extract the first 63 sectors of your harddisk. The MBR is the 1st sector, the GPT (if it exist) will be on the 2nd sector, and the rest is usually zeros - but if it contain something else, we will know what it is).
No promises I can help, but hopefully we can find something there.

5. If you want to do something write to MBR and afraid of screwing up, backup your disk first. I assume you can boot puppy through USB? If yes, get a USB external harddis of 200GB or more, install puppy on it, and ensure that your netbook can boot from this external harddisk.
Once you can do it, you can backup your entire disk to your USB disk like this:

Code: Select all

dd if=/dev/sda of=/mnt/sdb1/original-disk
assuming your USB harddisk is mounted at /mnt/sdb1.

cheers!
Fatdog64 forum links: [url=http://murga-linux.com/puppy/viewtopic.php?t=117546]Latest version[/url] | [url=https://cutt.ly/ke8sn5H]Contributed packages[/url] | [url=https://cutt.ly/se8scrb]ISO builder[/url]

User avatar
edoc
Posts: 4729
Joined: Sun 07 Aug 2005, 20:16
Location: Southeast Georgia, USA
Contact:

#30 Post by edoc »

# fdisk -l /dev/sda

Disk /dev/sda: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sda1 1 13 102400 7 HPFS/NTFS
Partition 1 does not end on cylinder boundary.
/dev/sda2 13 19458 156185600 7 HPFS/NTFS
"Sectors" is not a text file.

How to I handle that, please?
[b]Thanks! David[/b]
[i]Home page: [/i][url]http://nevils-station.com[/url]
[i]Don't google[/i] [b]Search![/b] [url]http://duckduckgo.com[/url]
TahrPup64 & Lighthouse64-b602 & JL64-603

jamesbond
Posts: 3433
Joined: Mon 26 Feb 2007, 05:02
Location: The Blue Marble

#31 Post by jamesbond »

edoc wrote:

Code: Select all

# fdisk -l /dev/sda

Disk /dev/sda: 160.0 GB, 160041885696 bytes
255 heads, 63 sectors/track, 19457 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1               1          13      102400    7  HPFS/NTFS
Partition 1 does not end on cylinder boundary.
/dev/sda2              13       19458   156185600    7  HPFS/NTFS
Hmmm this looks normal. So we need to look at the next few sectors to see why gparted choked on them.
"Sectors" is not a text file.
How to I handle that, please?
Open terminal, do this in /root:

Code: Select all

gzip -9 sectors
and upload the resulting sectors.gz here.

Btw - I'm not sure whether Fluppy has the command gdisk (I'm not running Fluppy now). If it has, can you do the command also:

Code: Select all

gdisk -l /dev/sda
cheers!
Fatdog64 forum links: [url=http://murga-linux.com/puppy/viewtopic.php?t=117546]Latest version[/url] | [url=https://cutt.ly/ke8sn5H]Contributed packages[/url] | [url=https://cutt.ly/se8scrb]ISO builder[/url]

User avatar
NETTKNUT
Posts: 135
Joined: Thu 27 Oct 2011, 09:51
Location: Wales

TestDisk Pet

#32 Post by NETTKNUT »

I tried to download testdisk-6.11.3.pet from http://www.murga-linux.com/puppy/viewtopic.php?t=28453 but got the message 'an error occurred'. Is there another pet I can download. My machine is a 660Mhz PII with 500 meg ram. any help appreciated. Thanks

slavvo67
Posts: 1610
Joined: Sat 13 Oct 2012, 02:07
Location: The other Mr. 305

#33 Post by slavvo67 »

Any particular reason why you need that version? I have 6.14 with menu icons if you want. Send me an e-mail slavvo67@gmail.com (two v's and letter o) and I'll get what I have over to you.

Best,

Slavvo67

User avatar
Semme
Posts: 8399
Joined: Sun 07 Aug 2011, 20:07
Location: World_Hub

#34 Post by Semme »

"SIX" YEARS AGO? >> http://www.murga-linux.com/puppy/viewtopic.php?t=28453

As pm'd.. self-contained and stand-alone..

User avatar
NETTKNUT
Posts: 135
Joined: Thu 27 Oct 2011, 09:51
Location: Wales

TestDisk Pet

#35 Post by NETTKNUT »

I was trying to get version 6.11.3 as it was the only one I could find on 'murga-linux'. I now have a direct URL for Test Disk instead. Thank you.

Post Reply