Comments (10)
I ran photorec against the image and it found around 150Gb of files
You are comparing apples and oranges: PhotoRec does file carving, it will not read any filesystem structure and will not recover file names or paths, nor it will work in case of fragmentation. Conversely, RecuperaBit reads the MFT or parts of it and reconstructs the directory tree. For any file in the tree it can read where the data is, even if the files are fragmented.
It could be that parts of the MFT are damaged or have been overwritten. It could also be that you are checking the CSV file list on the wrong partition number.
from recuperabit.
Thanks for response. Can you point me in the right direction for info. on which is the correct partition to analyse?
from recuperabit.
As a rule of thumb, it is usually the one with the largest number of files among those in the recoverable
list. But you should also check out other partitions with a large number of files so you can verify if you found what you are looking for.
from recuperabit.
I have obviously misunderstood Recuperabit. I thought that it worked from the bottom up, reconnecting file fragments until whole file/directory was recovered. I thought it didn't need MFT?
from recuperabit.
Hi, I have run Recuperabit against disk image. "Recoverable" finds plenty of partitions some of which have 100k+ files in them but file names are mostly meaningless. Would you advise?
Thanks
from recuperabit.
it worked from the bottom up, reconnecting file fragments until whole file/directory was recovered
This is slighlty incorrect, it rebuilds the directory tree from the bottom up by using individual records (or you could say fragments) of the Master File Table. When the directory tree is rebuilt, that part is done. Then the boundaries of the partition must be identified in order to recover file contents.
This is because MFT records include runlists and they are relative to the start of the file system.
More information can be found here: https://www.youtube.com/watch?v=AMYaagS6KF4
plenty of partitions some of which have 100k+ files
This is not entirely uncommon, especially for drives that were fragmented.You can try checking them one by one in order to find where the files are. Hopefully the data has not been pruned by the usual TRIM procedures that run on SSDs.
from recuperabit.
Hi Not sure why you closed this as I still have some queries (I appreciate that your time is precious and that you are doing this out of the goodness of your heart!). As I said, "Recoverable" finds an awful lot of partitions (See attached screenshot and there are pages and pages of partitions.) but even the ones with thousands of files do not contain anything I am looking for. This disk went to RAW for no apparent reason and has been untouched since so nothing should have been overwritten or trimmed. Is the only answer to trawl through all these partitions to try to find my data?
Thanks for your help.
from recuperabit.
If you don't find the data, maybe it is not recoverable or maybe the program is not the right tool for your case. You can surely compare it to other solutions, and you could get better results with other software (it happens).
You could also try and merge those two large partitions with the same offset, keeping in mind this is an experimental feature and it should be done only if they are really two parts of the same fragmented MFT (so file record identifiers do not overlap).
Personally I would not have made a copy of a potentially failing drive with dd
, skipping entire blocks of 4K bytes when it encounters an error, I'd rather use ddrescue
, but this is just a preference.
from recuperabit.
from recuperabit.
I mean those with the same offset value, for instance most of those seen in your screenshot have an offset of 206848 sectors.
from recuperabit.
Related Issues (20)
- Removed HOT 1
- Gave me an error after typing "tree" and exited HOT 5
- How to use with windows HOT 1
- Windows exe ? HOT 7
- Recoverable partition but only restores a few files. HOT 5
- Add a command to savefile once scan has ended.
- A better tree command HOT 2
- Function best_name crashes while sorting entries HOT 2
- RecursionError: maximum recursion depth exceeded HOT 2
- Traceback when using saved scan file. HOT 1
- Unicode in filenames makes the program crash HOT 2
- Cannot restore non-resident $DATA attribute(s) HOT 4
- CSV export should include the full path of files
- Different partition #s generated for save file vs. rescan of drive image HOT 1
- Doesn't work for my disk HOT 3
- Unbound Local Error HOT 1
- Adding simple test image files
- recover breaks when custom properties appear as nodes HOT 1
- I don't understand HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from recuperabit.