Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

"It runs like _x, where _x is something unsavory" -- Prof. Romas Aleliunas, CS 435


computers / comp.os.linux.misc / Re: TestDisk,PhotoRec , or a Data Recovery Service First?

SubjectAuthor
* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Keith Scarlett
`* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Carlos E. R.
 `* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Keith Scarlett
  `* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Carlos E. R.
   `* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Pascal Hambourg
    `* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Carlos E. R.
     +* Re: TestDisk,PhotoRec , or a Data Recovery Service First?The Natural Philosopher
     |`- Re: TestDisk,PhotoRec , or a Data Recovery Service First?Carlos E. R.
     `* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Pascal Hambourg
      `* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Carlos E. R.
       `* Re: TestDisk,PhotoRec , or a Data Recovery Service First?Pascal Hambourg
        `- Re: TestDisk,PhotoRec , or a Data Recovery Service First?Carlos E. R.

1
Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7668&group=comp.os.linux.misc#7668

 copy link   Newsgroups: comp.os.linux.misc
X-Received: by 2002:a05:620a:1035:: with SMTP id a21mr5237658qkk.422.1631630447680;
Tue, 14 Sep 2021 07:40:47 -0700 (PDT)
X-Received: by 2002:a25:cd45:: with SMTP id d66mr22210872ybf.74.1631630445777;
Tue, 14 Sep 2021 07:40:45 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!news.misty.com!border2.nntp.dca1.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.os.linux.misc
Date: Tue, 14 Sep 2021 07:40:45 -0700 (PDT)
In-Reply-To: <fc2jhh-1fh.ln1@Telcontar.valinor>
Injection-Info: google-groups.googlegroups.com; posting-host=82.132.244.21; posting-account=_unA3goAAABIXzCrkrH0xkPF-jUJZkLD
NNTP-Posting-Host: 82.132.244.21
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com> <bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com> <c9mhhh-avb.ln1@Telcontar.valinor>
<6046376b$0$19468$426a74cc@news.free.fr> <fc2jhh-1fh.ln1@Telcontar.valinor>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
From: kscarlettmail@gmail.com (Keith Scarlett)
Injection-Date: Tue, 14 Sep 2021 14:40:47 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Lines: 47
 by: Keith Scarlett - Tue, 14 Sep 2021 14:40 UTC

On Tuesday, March 9, 2021 at 2:20:09 AM UTC, Carlos E.R. wrote:
> On 08/03/2021 15.40, Pascal Hambourg wrote:
> > Le 08/03/2021 à 14:43, Carlos E.R. a écrit :
> >> On 08/03/2021 00.30, Steve Mysterious wrote:
> >>>
> >>> I think the saving graces in my situation were that the nautilus file
> >>> manager in Mint & Cinnamon only did quick formatting and that my
> >>> drive was completely undamaged.
> >>
> >> This is the default for all formatting/partitioning tools (in Linux at
> >> least). Only the metadata area is reset (not necessarily erased).
> >
> > Not all tools. The default for mkntfs from ntfs-3g is a "long" format.
> Why?
>
> Something in the ntfs filesystem assumes that a sector is zeroed?
> >
> >> Reasoning is, there is no longer the need to low level format hard
> >> disk (even impossible), and erasing all the sectors, in rotating disk
> >> takes hours, and in SSD disks reduces the life of the disk significantly.
> >
> > But discard (TRIM) of all free blocks is fast and harmless.
> > Guess what ? it seems to be the default for mke2fs, mkfs.btrfs and
> > mkfs.xfs. Beware !
> --
> Cheers, Carlos.

Hello,

Firstly thanks all for the contributions, really useful. I have done something very similar (identical?) i.e. I was trying to format (write a disk image) to a memory stick while I also had a 500GB external drive attached and unfortunately started to write the image to the 500GB drive. I think I noticed after approx. 30 seconds.

What value is there in me trying to use TestDisk as suggested in this thread? Before I use TestDisk is it worth trying to PhotoRec first? The data on the 500GB is important so any help / guidance much appreciated. I have a Linux Mint system and I was trying to write the image using 'USB Stick Writer', a software that's included with Linux Mint installations.

Thanks,

Keith

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<q6r61ixjmr.ln2@minas-tirith.valinor>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7669&group=comp.os.linux.misc#7669

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: robin_listas@es.invalid (Carlos E. R.)
Newsgroups: comp.os.linux.misc
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Date: Tue, 14 Sep 2021 17:20:26 +0200
Lines: 36
Message-ID: <q6r61ixjmr.ln2@minas-tirith.valinor>
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Trace: individual.net G0kr08o2hLbGLAwkiCgh6w1Wfo7+6hZ+NF/oh/aQLqQvHCmhg/
X-Orig-Path: minas-tirith.valinor!not-for-mail
Cancel-Lock: sha1:SFhZ+cL9/LJaHANeO3c5N77TTX8=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.12.0
In-Reply-To: <f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
Content-Language: en-GB
 by: Carlos E. R. - Tue, 14 Sep 2021 15:20 UTC

On 14/09/2021 16.40, Keith Scarlett wrote:

....

>
> Hello,
>
> Firstly thanks all for the contributions, really useful. I have done something very similar (identical?) i.e. I was trying to format (write a disk image) to a memory stick while I also had a 500GB external drive attached and unfortunately started to write the image to the 500GB drive. I think I noticed after approx. 30 seconds.
>
> What value is there in me trying to use TestDisk as suggested in this thread? Before I use TestDisk is it worth trying to PhotoRec first? The data on the 500GB is important so any help / guidance much appreciated. I have a Linux Mint system and I was trying to write the image using 'USB Stick Writer', a software that's included with Linux Mint installations.

How big was that memory stick?

The first step always should be to clone the disk to another one or as
image file. Then you work at the image.

If at all possible, you would clone it first, mark it read only, then a
copy of the copy and work on that one. If you have to restart, you
create another copy from the initial first copy, not the original.

The first attempt should be testdisk.

If that fails, recreate the copy and attempt photorec or similar tool.

Photorec scans all the sectors looking for known types of files, mostly
photos. It is possible that other tools scan better other types of
files. It is a very slow procedure.

You should also consider "foremost".

Any other attempt, create a secondary copy and work on it, never on the
original.

--
Cheers,
Carlos E.R.

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7680&group=comp.os.linux.misc#7680

 copy link   Newsgroups: comp.os.linux.misc
X-Received: by 2002:a0c:f38b:: with SMTP id i11mr7073146qvk.42.1631820065366;
Thu, 16 Sep 2021 12:21:05 -0700 (PDT)
X-Received: by 2002:a25:ab2d:: with SMTP id u42mr9519327ybi.481.1631820065097;
Thu, 16 Sep 2021 12:21:05 -0700 (PDT)
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!news.misty.com!border2.nntp.dca1.giganews.com!nntp.giganews.com!news-out.google.com!nntp.google.com!postnews.google.com!google-groups.googlegroups.com!not-for-mail
Newsgroups: comp.os.linux.misc
Date: Thu, 16 Sep 2021 12:21:04 -0700 (PDT)
In-Reply-To: <q6r61ixjmr.ln2@minas-tirith.valinor>
Injection-Info: google-groups.googlegroups.com; posting-host=82.132.244.132; posting-account=_unA3goAAABIXzCrkrH0xkPF-jUJZkLD
NNTP-Posting-Host: 82.132.244.132
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com> <bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com> <c9mhhh-avb.ln1@Telcontar.valinor>
<6046376b$0$19468$426a74cc@news.free.fr> <fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com> <q6r61ixjmr.ln2@minas-tirith.valinor>
User-Agent: G2/1.0
MIME-Version: 1.0
Message-ID: <d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
From: kscarlettmail@gmail.com (Keith Scarlett)
Injection-Date: Thu, 16 Sep 2021 19:21:05 +0000
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Lines: 51
 by: Keith Scarlett - Thu, 16 Sep 2021 19:21 UTC

> How big was that memory stick?
>
> The first step always should be to clone the disk to another one or as
> image file. Then you work at the image.
>
> If at all possible, you would clone it first, mark it read only, then a
> copy of the copy and work on that one. If you have to restart, you
> create another copy from the initial first copy, not the original.
>
> The first attempt should be testdisk.
>
> If that fails, recreate the copy and attempt photorec or similar tool.
>
> Photorec scans all the sectors looking for known types of files, mostly
> photos. It is possible that other tools scan better other types of
> files. It is a very slow procedure.
>
> You should also consider "foremost".
>
> Any other attempt, create a secondary copy and work on it, never on the
> original.
>
> --
> Cheers,
> Carlos E.R.

Thank-you for the reply. So the memory stick was 15GB (the intended write target) but the external HDD I accidentally wrote the disk image to was 500GB.

Using the dd command should I be trying to clone the drive or write an image of that drive? Are these actually different procedures or am I confused?

Based on the OP's experience it seems I'll have to get a 2TB external drive (then partition this) if I want to clone the 500GB external drive and then have a copy of that, does that sound right?

In TestDisk how obvious is it that it has found the correct / 'deleted' partition, what should I be looking for after TestDisk has analysed the cloned image? I'm 99.99% sure it would have been a FAT partition about 500GB in size and that anything created during the accidental write would be something else, perhaps ISO?

What is the likelihood of full data recovery given the circumstances? What is the likelihood of partial data recovery?

Thanks,

Keith

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<6h5d1ixhif.ln2@minas-tirith.valinor>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7682&group=comp.os.linux.misc#7682

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!4.us.feeder.erje.net!3.eu.feeder.erje.net!feeder.erje.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: robin_listas@es.invalid (Carlos E. R.)
Newsgroups: comp.os.linux.misc
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Date: Fri, 17 Sep 2021 02:53:25 +0200
Lines: 71
Message-ID: <6h5d1ixhif.ln2@minas-tirith.valinor>
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Trace: individual.net mljR8pDcRtY/tARKO3KUqQhuICcIa3BeShdPzIxuf5OzjTDHYQ
X-Orig-Path: minas-tirith.valinor!not-for-mail
Cancel-Lock: sha1:cY1U7QgBMsfGJSlboBcWxzv6O/8=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.12.0
In-Reply-To: <d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
Content-Language: en-GB
 by: Carlos E. R. - Fri, 17 Sep 2021 00:53 UTC

On 16/09/2021 21.21, Keith Scarlett wrote:
>> How big was that memory stick?
>>
>> The first step always should be to clone the disk to another one or as
>> image file. Then you work at the image.
>>
>> If at all possible, you would clone it first, mark it read only, then a
>> copy of the copy and work on that one. If you have to restart, you
>> create another copy from the initial first copy, not the original.
>>
>> The first attempt should be testdisk.
>>
>> If that fails, recreate the copy and attempt photorec or similar tool.
>>
>> Photorec scans all the sectors looking for known types of files, mostly
>> photos. It is possible that other tools scan better other types of
>> files. It is a very slow procedure.
>>
>> You should also consider "foremost".
>>
>> Any other attempt, create a secondary copy and work on it, never on the
>> original.

> Thank-you for the reply. So the memory stick was 15GB (the intended write target) but the external HDD I accidentally wrote the disk image to was 500GB.
>
> Using the dd command should I be trying to clone the drive or write an image of that drive? Are these actually different procedures or am I confused?

Depends on what you have available to write the copy to. For example, if
you have a 4TB disk, create an image copy.

Example.

Corrupted disk is /dev/sdX

Empty 4 TB disk is /dev/sdY, and you mount it on /workspace

You would do:

dd if=/dev/sdX of=/workspace/ClonedImageOfCorruptedDisk.img bs=100MB

(4TB happens to be the sweet spot of price/size where I live)

> Based on the OP's experience it seems I'll have to get a 2TB external drive (then partition this) if I want to clone the 500GB external drive and then have a copy of that, does that sound right?

That would be nice, yes.

> In TestDisk how obvious is it that it has found the correct / 'deleted' partition, what should I be looking for after TestDisk has analysed the cloned image? I'm 99.99% sure it would have been a FAT partition about 500GB in size and that anything created during the accidental write would be something else, perhaps ISO?

Ideally, you could mount the 500GB repaired image and you could read it
- except the first 15GB, so the original directory structure would be
lost. Hopefully there would be a "reconstructed" structure of invented
names.

>
> What is the likelihood of full data recovery given the circumstances? What is the likelihood of partial data recovery?

Partial data recovery, very good. What software will finally manage to
do it, I don't know. You have to try and select the best result...

Look, I know better how to actually do it (following my nose) than
describe it.

--
Cheers,
Carlos E.R.

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<614427d9$0$5974$426a74cc@news.free.fr>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7683&group=comp.os.linux.misc#7683

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!aioe.org!usenet.goja.nl.eu.org!3.eu.feeder.erje.net!feeder.erje.net!feeder1-2.proxad.net!proxad.net!feeder1-1.proxad.net!cleanfeed2-a.proxad.net!nnrp1-2.free.fr!not-for-mail
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Newsgroups: comp.os.linux.misc
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor>
From: pascal@plouf.fr.eu.org (Pascal Hambourg)
Date: Fri, 17 Sep 2021 07:30:01 +0200
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:78.0) Gecko/20100101
Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <6h5d1ixhif.ln2@minas-tirith.valinor>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Lines: 11
Message-ID: <614427d9$0$5974$426a74cc@news.free.fr>
Organization: Guest of ProXad - France
NNTP-Posting-Date: 17 Sep 2021 07:30:01 CEST
NNTP-Posting-Host: 213.41.155.166
X-Trace: 1631856601 news-1.free.fr 5974 213.41.155.166:38588
X-Complaints-To: abuse@proxad.net
 by: Pascal Hambourg - Fri, 17 Sep 2021 05:30 UTC

Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
> On 16/09/2021 21.21, Keith Scarlett wrote:
>
>> So the memory stick was 15GB (the intended write target) but the external HDD I accidentally wrote the disk image to was 500GB.
(...)
> Ideally, you could mount the 500GB repaired image and you could read it
> - except the first 15GB

Why 15 GB ? The intended destination drive size is irrelevant. What
matters is the written image size or the write speed (45 MB/s max if USB
2, more if USB 3) * write time, whichever is higher.

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<vf6e1ix6rh.ln2@minas-tirith.valinor>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7684&group=comp.os.linux.misc#7684

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: robin_listas@es.invalid (Carlos E. R.)
Newsgroups: comp.os.linux.misc
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Date: Fri, 17 Sep 2021 12:15:59 +0200
Lines: 24
Message-ID: <vf6e1ix6rh.ln2@minas-tirith.valinor>
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor> <614427d9$0$5974$426a74cc@news.free.fr>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Trace: individual.net jTt3Th0upiHZpQlfDlvAbA+jBgsVkD3d2TE+1bYQUJthOfDCL7
X-Orig-Path: minas-tirith.valinor!not-for-mail
Cancel-Lock: sha1:FyKMZxBzpbeqEEW3QHSk4VYpGvA=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.12.0
In-Reply-To: <614427d9$0$5974$426a74cc@news.free.fr>
Content-Language: en-GB
 by: Carlos E. R. - Fri, 17 Sep 2021 10:15 UTC

On 17/09/2021 07.30, Pascal Hambourg wrote:
> Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
>> On 16/09/2021 21.21, Keith Scarlett wrote:
>>
>>> So the memory stick was 15GB (the intended write target) but the
>>> external HDD I accidentally wrote the disk image to was 500GB.
> (...)
>> Ideally, you could mount the 500GB repaired image and you could read it
>> - except the first 15GB
>
> Why 15 GB ? The intended destination drive size is irrelevant. What
> matters is the written image size or the write speed (45 MB/s max if USB
> 2, more if USB 3) * write time, whichever is higher.

Maybe you missed that he overwrote his good disk with an image for an
USB stick of 15 GB. It is not the destination drive, it is the max
corruption size.

Knowing the actual size of the source image would be better. If it was a
partial write, dd would say how much it actually wrote.

--
Cheers,
Carlos E.R.

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<si21d1$85c$1@dont-email.me>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7685&group=comp.os.linux.misc#7685

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!aioe.org!eternal-september.org!reader02.eternal-september.org!.POSTED!not-for-mail
From: tnp@invalid.invalid (The Natural Philosopher)
Newsgroups: comp.os.linux.misc
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Date: Fri, 17 Sep 2021 13:24:00 +0100
Organization: A little, after lunch
Lines: 35
Message-ID: <si21d1$85c$1@dont-email.me>
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor> <614427d9$0$5974$426a74cc@news.free.fr>
<vf6e1ix6rh.ln2@minas-tirith.valinor>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Injection-Date: Fri, 17 Sep 2021 12:24:01 -0000 (UTC)
Injection-Info: reader02.eternal-september.org; posting-host="ef6b81740d03aca99e604a15205504c6";
logging-data="8364"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX19C2UgJQrzrfGyOQN030iPmLCH/zw1T5xw="
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Thunderbird/60.6.1
Cancel-Lock: sha1:T26X9rHPevrbH9fgLqyC8M8Ud6o=
In-Reply-To: <vf6e1ix6rh.ln2@minas-tirith.valinor>
Content-Language: en-GB
 by: The Natural Philosop - Fri, 17 Sep 2021 12:24 UTC

On 17/09/2021 11:15, Carlos E. R. wrote:
> On 17/09/2021 07.30, Pascal Hambourg wrote:
>> Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
>>> On 16/09/2021 21.21, Keith Scarlett wrote:
>>>
>>>> So the memory stick was 15GB (the intended write target) but the
>>>> external HDD I accidentally wrote the disk image to was 500GB.
>> (...)
>>> Ideally, you could mount the 500GB repaired image and you could read it
>>> - except the first 15GB
>>
>> Why 15 GB ? The intended destination drive size is irrelevant. What
>> matters is the written image size or the write speed (45 MB/s max if USB
>> 2, more if USB 3) * write time, whichever is higher.
>
> Maybe you missed that he overwrote his good disk with an image for an
> USB stick of 15 GB. It is not the destination drive, it is the max
> corruption size.
>
> Knowing the actual size of the source image would be better. If it was a
> partial write, dd would say how much it actually wrote.
>
Problem is that the first thing to get written would be the directory tracks

there are other block metadata areas in ext2/4 but thats the main one

Data may still be there, but no reason to suppose its more than a random
collection of sectors.

--
When plunder becomes a way of life for a group of men in a society, over
the course of time they create for themselves a legal system that
authorizes it and a moral code that glorifies it.

Frédéric Bastiat

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<b1ge1ixptn.ln2@minas-tirith.valinor>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7686&group=comp.os.linux.misc#7686

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: robin_listas@es.invalid (Carlos E. R.)
Newsgroups: comp.os.linux.misc
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Date: Fri, 17 Sep 2021 14:58:51 +0200
Lines: 46
Message-ID: <b1ge1ixptn.ln2@minas-tirith.valinor>
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor> <614427d9$0$5974$426a74cc@news.free.fr>
<vf6e1ix6rh.ln2@minas-tirith.valinor> <si21d1$85c$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Trace: individual.net Cjdvb+INHmSU5LKrhvuoWQeKEEUTHqeFRfN7+8vGSiCzXHmI6k
X-Orig-Path: minas-tirith.valinor!not-for-mail
Cancel-Lock: sha1:nnHiR7RpzT4PSY6XUgMxex4hjI0=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.12.0
In-Reply-To: <si21d1$85c$1@dont-email.me>
Content-Language: en-GB
 by: Carlos E. R. - Fri, 17 Sep 2021 12:58 UTC

On 17/09/2021 14.24, The Natural Philosopher wrote:
> On 17/09/2021 11:15, Carlos E. R. wrote:
>> On 17/09/2021 07.30, Pascal Hambourg wrote:
>>> Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
>>>> On 16/09/2021 21.21, Keith Scarlett wrote:
>>>>
>>>>> So the memory stick was 15GB (the intended write target) but the
>>>>> external HDD I accidentally wrote the disk image to was 500GB.
>>> (...)
>>>> Ideally, you could mount the 500GB repaired image and you could read it
>>>> - except the first 15GB
>>>
>>> Why 15 GB ? The intended destination drive size is irrelevant. What
>>> matters is the written image size or the write speed (45 MB/s max if USB
>>> 2, more if USB 3) * write time, whichever is higher.
>>
>> Maybe you missed that he overwrote his good disk with an image for an
>> USB stick of 15 GB. It is not the destination drive, it is the max
>> corruption size.
>>
>> Knowing the actual size of the source image would be better. If it was a
>> partial write, dd would say how much it actually wrote.
>>
> Problem is that the first thing to get written would be the directory
> tracks

Yep.

>
> there are other block metadata areas in ext2/4 but thats the main one

I think he said it was FAT. If that is so, the FAT table would be gone,
and then the master directory structure. Possibly some subdirectories
tables would remain.

>
> Data may still be there, but no reason to suppose its more than a random
> collection of sectors.

Even in that case, file carving tools manage good results. Not the file
names in this case, though.

--
Cheers,
Carlos E.R.

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<61450cd2$0$6454$426a34cc@news.free.fr>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7690&group=comp.os.linux.misc#7690

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!cleanfeed1-b.proxad.net!nnrp4-2.free.fr!not-for-mail
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Newsgroups: comp.os.linux.misc
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor> <614427d9$0$5974$426a74cc@news.free.fr>
<vf6e1ix6rh.ln2@minas-tirith.valinor>
From: pascal@plouf.fr.eu.org (Pascal Hambourg)
Date: Fri, 17 Sep 2021 23:46:58 +0200
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:78.0) Gecko/20100101
Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <vf6e1ix6rh.ln2@minas-tirith.valinor>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Lines: 16
Message-ID: <61450cd2$0$6454$426a34cc@news.free.fr>
Organization: Guest of ProXad - France
NNTP-Posting-Date: 17 Sep 2021 23:46:58 CEST
NNTP-Posting-Host: 213.41.155.166
X-Trace: 1631915218 news-4.free.fr 6454 213.41.155.166:48002
X-Complaints-To: abuse@proxad.net
 by: Pascal Hambourg - Fri, 17 Sep 2021 21:46 UTC

Le 17/09/2021 à 12:15, Carlos E. R. a écrit :
> On 17/09/2021 07.30, Pascal Hambourg wrote:
>> Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
>>>
>>> Ideally, you could mount the 500GB repaired image and you could read it
>>> - except the first 15GB
>>
>> Why 15 GB ? The intended destination drive size is irrelevant. What
>> matters is the written image size or the write speed (45 MB/s max if USB
>> 2, more if USB 3) * write time, whichever is higher.
>
> Maybe you missed that he overwrote his good disk with an image for an
> USB stick of 15 GB.

Again, the USB stick size is irrelevant.
Where did you see that the image size was 15 GB ?

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<gepf1ix875.ln2@minas-tirith.valinor>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7691&group=comp.os.linux.misc#7691

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: robin_listas@es.invalid (Carlos E. R.)
Newsgroups: comp.os.linux.misc
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Date: Sat, 18 Sep 2021 02:45:36 +0200
Lines: 23
Message-ID: <gepf1ix875.ln2@minas-tirith.valinor>
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor> <614427d9$0$5974$426a74cc@news.free.fr>
<vf6e1ix6rh.ln2@minas-tirith.valinor> <61450cd2$0$6454$426a34cc@news.free.fr>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Trace: individual.net /uUSiYyBVhUVfLCYhaTm8AguIEgpsRG+gPFBprtRxfDorDI5Xn
X-Orig-Path: minas-tirith.valinor!not-for-mail
Cancel-Lock: sha1:g3nPHRlgk1i8uS5gRxVIShxdT9g=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.12.0
In-Reply-To: <61450cd2$0$6454$426a34cc@news.free.fr>
Content-Language: en-GB
 by: Carlos E. R. - Sat, 18 Sep 2021 00:45 UTC

On 17/09/2021 23.46, Pascal Hambourg wrote:
> Le 17/09/2021 à 12:15, Carlos E. R. a écrit :
>> On 17/09/2021 07.30, Pascal Hambourg wrote:
>>> Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
>>>>
>>>> Ideally, you could mount the 500GB repaired image and you could read it
>>>> - except the first 15GB
>>>
>>> Why 15 GB ? The intended destination drive size is irrelevant. What
>>> matters is the written image size or the write speed (45 MB/s max if USB
>>> 2, more if USB 3) * write time, whichever is higher.
>>
>> Maybe you missed that he overwrote his good disk with an image for an
>> USB stick of 15 GB.
>
> Again, the USB stick size is irrelevant.
> Where did you see that the image size was 15 GB ?

It is obvious, no?

--
Cheers,
Carlos E.R.

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<614595a4$0$5961$426a74cc@news.free.fr>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7692&group=comp.os.linux.misc#7692

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!weretis.net!feeder8.news.weretis.net!proxad.net!feeder1-2.proxad.net!cleanfeed2-a.proxad.net!nnrp1-2.free.fr!not-for-mail
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Newsgroups: comp.os.linux.misc
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor> <614427d9$0$5974$426a74cc@news.free.fr>
<vf6e1ix6rh.ln2@minas-tirith.valinor> <61450cd2$0$6454$426a34cc@news.free.fr>
<gepf1ix875.ln2@minas-tirith.valinor>
From: pascal@plouf.fr.eu.org (Pascal Hambourg)
Date: Sat, 18 Sep 2021 09:30:44 +0200
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:78.0) Gecko/20100101
Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <gepf1ix875.ln2@minas-tirith.valinor>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Lines: 24
Message-ID: <614595a4$0$5961$426a74cc@news.free.fr>
Organization: Guest of ProXad - France
NNTP-Posting-Date: 18 Sep 2021 09:30:44 CEST
NNTP-Posting-Host: 213.41.155.166
X-Trace: 1631950244 news-3.free.fr 5961 213.41.155.166:40490
X-Complaints-To: abuse@proxad.net
 by: Pascal Hambourg - Sat, 18 Sep 2021 07:30 UTC

Le 18/09/2021 à 02:45, Carlos E. R. a écrit :
> On 17/09/2021 23.46, Pascal Hambourg wrote:
>> Le 17/09/2021 à 12:15, Carlos E. R. a écrit :
>>> On 17/09/2021 07.30, Pascal Hambourg wrote:
>>>> Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
>>>>>
>>>>> Ideally, you could mount the 500GB repaired image and you could read it
>>>>> - except the first 15GB
>>>>
>>>> Why 15 GB ? The intended destination drive size is irrelevant. What
>>>> matters is the written image size or the write speed (45 MB/s max if USB
>>>> 2, more if USB 3) * write time, whichever is higher.
>>>
>>> Maybe you missed that he overwrote his good disk with an image for an
>>> USB stick of 15 GB.
>>
>> Again, the USB stick size is irrelevant.
>> Where did you see that the image size was 15 GB ?
>
> It is obvious, no?

No. I, as most people, usually write images on USB sticks bigger than
the image size.

Re: TestDisk,PhotoRec , or a Data Recovery Service First?

<q5og1ix4c7.ln2@minas-tirith.valinor>

 copy mid

https://www.rocksolidbbs.com/computers/article-flat.php?id=7693&group=comp.os.linux.misc#7693

 copy link   Newsgroups: comp.os.linux.misc
Path: i2pn2.org!i2pn.org!news.swapon.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: robin_listas@es.invalid (Carlos E. R.)
Newsgroups: comp.os.linux.misc
Subject: Re: TestDisk,PhotoRec , or a Data Recovery Service First?
Date: Sat, 18 Sep 2021 11:30:02 +0200
Lines: 33
Message-ID: <q5og1ix4c7.ln2@minas-tirith.valinor>
References: <9668a100-1319-482d-82e8-4bcd59c5e86an@googlegroups.com>
<6ab906d8-8102-4f26-8568-f571863eee48n@googlegroups.com>
<bqtfhh-o4p.ln1@Telcontar.valinor>
<1cf3d421-3048-4eab-a7d1-0d0d5a946cefn@googlegroups.com>
<c9mhhh-avb.ln1@Telcontar.valinor> <6046376b$0$19468$426a74cc@news.free.fr>
<fc2jhh-1fh.ln1@Telcontar.valinor>
<f2375b25-b953-4565-9687-242cf6c1ed36n@googlegroups.com>
<q6r61ixjmr.ln2@minas-tirith.valinor>
<d1138f5e-c2f4-483b-beb4-44f4b8653646n@googlegroups.com>
<6h5d1ixhif.ln2@minas-tirith.valinor> <614427d9$0$5974$426a74cc@news.free.fr>
<vf6e1ix6rh.ln2@minas-tirith.valinor> <61450cd2$0$6454$426a34cc@news.free.fr>
<gepf1ix875.ln2@minas-tirith.valinor> <614595a4$0$5961$426a74cc@news.free.fr>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Trace: individual.net zuKsHT3hR2dv30pwh6prpQ9B66r3TByzmAUnnlrzoDLF9nFDbN
X-Orig-Path: minas-tirith.valinor!not-for-mail
Cancel-Lock: sha1:mT70k9oZDw7S/xL2wlDPpeocX2I=
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.12.0
In-Reply-To: <614595a4$0$5961$426a74cc@news.free.fr>
Content-Language: en-GB
 by: Carlos E. R. - Sat, 18 Sep 2021 09:30 UTC

On 18/09/2021 09.30, Pascal Hambourg wrote:
> Le 18/09/2021 à 02:45, Carlos E. R. a écrit :
>> On 17/09/2021 23.46, Pascal Hambourg wrote:
>>> Le 17/09/2021 à 12:15, Carlos E. R. a écrit :
>>>> On 17/09/2021 07.30, Pascal Hambourg wrote:
>>>>> Le 17/09/2021 à 02:53, Carlos E. R. a écrit :
>>>>>>
>>>>>> Ideally, you could mount the 500GB repaired image and you could
>>>>>> read it
>>>>>> - except the first 15GB
>>>>>
>>>>> Why 15 GB ? The intended destination drive size is irrelevant. What
>>>>> matters is the written image size or the write speed (45 MB/s max
>>>>> if USB
>>>>> 2, more if USB 3) * write time, whichever is higher.
>>>>
>>>> Maybe you missed that he overwrote his good disk with an image for an
>>>> USB stick of 15 GB.
>>>
>>> Again, the USB stick size is irrelevant.
>>> Where did you see that the image size was 15 GB ?
>>
>> It is obvious, no?
>
> No. I, as most people, usually write images on USB sticks bigger than
> the image size.
>

Right, but it would not be bigger than 15GB ;-)

--
Cheers,
Carlos E.R.

1
server_pubkey.txt

rocksolid light 0.9.7
clearnet tor