A friend of mine has 2 Windows Laptops, where in the process of moving from an old 2TB storage laptop to a newer 256GB storage laptop, moving files manually (somehow, dont ask me).

They noticed they accidentally removed a 35GB folder full of media files from a very big vacation, including nature photography and some strange GoPro format files. Valuable stuff.

So we took the newer laptop as its fresh, very small storage and not much done after deleting the files.

We used a 2TB backup drive which works well.

Used CloneZilla, exited to shell, mounted the drive with udisksctl and used testdisk and photorec, but with strange results.

  1. Testdisk created a “whole” recovery in .dd format
  2. Then noticed the “undelete” function in testdisk and manually undeleted all files we found
  3. Then used photorec on that .dd recovery

The testdisk undelete files are mostly corrupted, images with missing header files etc. Same as the result of some magic sauce proprietary recovery program.

The photorec results where really strange, everything was intact but only system stuff, cache, icons etc, not a single of the deleted media.

The media are 3000 or more, so this makes no sense, we used the “full” backup from testdisk.

The laptop is off and we have some time, we can also use the older, messier one if needed.

Questions:

  • any way to repair these corrupted images and media?
  • how to work with this data in photorec? How to export just the deleted files?

I think we should try to use photorec directly with the drive and not the .dd image, which may help.

We used dd and cloned the entire small, new disk to an .iso on the backup drive so we can work with it easier. Does this include all the stuff, also the deleted things?

We will also try scalpel.

Thanks!

Update

We did a lot with the small disk which should basically be in perfect condition to undelete stuff.

  • dd and ddrescue backup into an .iso and .raw image
  • testdisk backup into a .dd image
  • photorec found only usable pictures from the OS, not a single of the wanted ones
  • testdisk and Recuva had the exact same results, all of the wanted files but all broken, missing headers and metadata
  • using scalpel currently

I would be happy about experience on how to restore such header files, information what they are and if you can use files for multiple media or guess them. We know the filetypes that we search for.

Also, are there any modern recovery tools out there, that promise better reliability?

Thanks!

  • mranderson17@infosec.pub
    7·
    7 months ago

    So, I’m not sure if the process has changed in the last decade or so but in a long-ago computer forensics class step 0, before all else, was to never operate data recovery on the original disk. Create a block level image of the entire device, then work on that.

    My go to steps for recovery have been the following in the years since:

    1. create an image of the entire disk (not a partition) using ddrescue ddrescue -d /dev/sdX .img
    2. Run test disk on it selecting the partitions as necessary testdisk .img

    If the disk has a complicated partition layout, or more effort is required to find the correct partition you can also mount parts of the disk.

    1. create an image of the entire disk (not a partition) using ddrescue

      ddrescue -d /dev/sdX .img

    2. Mount the image as a loopback device with the appropriate offset

      losetup --offset --show -v -r -f -P .img this will mount individual partitions:

      loop58        7:58   0 465.8G  1 loop
├─loop58p1  259:7    0   1.5G  1 part
├─loop58p2  259:8    0 450.6G  1 part
└─loop58p3  259:9    0  13.7G  1 part

    3. Then operate testdisk on whatever partition you want.

    All that said there are a lot of variables here and things don’t always work perfectly. I hope you do find a way to recover them.

    • Pantherina@feddit.deOP
      1·
      7 months ago

      Thanks, I dont think the common tools are dangerous to work with the original, but I now have 3 backups in various approaches and will wait until I find a solution on how to restore header files, as this seems to be kinda impossible to recover (“secure delete”)