How to recover wiped/deleted/lost files from external drive?

[br1anstorm]

Disaster has struck - in an unexpected way. The external HDD on which I saved all my data (docs, pics, music etc) has become corrupted. How can I rescue my data?

The basics, first:
I have a dual boot setup on my laptop: Windows 7 and Mint. Both work fine. In order to be able to access fies from both, I have a 1TB external hard drive, formatted NTFS, onto which I save almost all my data/files.

(Comment - hindsight is a wonderful thing: I had saved all my files on to an external drive because I reckoned that was safer, and would preserve the data if, as I feared more likely, the Win7 or Mint on the main internal drive crashed... So my vital files were there, not on the Mint or Windows partitions.)

A few days ago I had a trial run with Timeshift in Mint (because I was thinking of a kernel upgrade). This resulted in an absolutely huge (maybe 200GB) 'timeshift' folder on that external drive - possibly because I had not adjusted the Timeshift settings? Anyway, I decided to disable Timeshift, postpone any kernel change, and delete those backups in the folder on my external drive. I did so, freeing up a lot of space. Should have left it at that....BUT...

As the external HDD was NTFS, and as I had just deleted a massive amount of timeshift data, I thought it might be sensible to go into Win7 and defrag that drive. I did so. But the defrag seemed to hang at about 10%. So I decided to cancel the defragging.

The problem:
Having tried ( I thought) to 'clean up' that external HDD, I then booted back into Mint to have a look at it. The HDD could not be mounted. A lengthy error message came up. I did not copy it all. But the key point was that the disk was corrupted, and that I should run chkdsk /f (in Windows) and reboot twice, and/or run ntfsfix... and then it had a lot more stuff about RAID etc which I did not understand and presumed was irrelevant.

So.... I went back into Win7, and ran

Code: Select all

chkdsk F: /f

from the command line (F was the affected drive as seen by Win7). That completed in a matter of seconds, and in the terminal it said that any corrupted sectors or disk errors (there weren't many) had been fixed.....

So I then looked at the drive (both in Win7 and in Mint - where it mounted fine). But - shock, horror - the disk now appears to be empty. All my (about 500GB) data - all my docs, photos, personal files, spreadsheets, correspondence, everything - gone. No folders, no files, nothing.

This is apocalypse. Desperate situation.

What to do? I have the (free) Recuva program in Win7. So I am currently running that. It says it will take some 6 hours. But I have no idea what, if anything it might deliver (though I have my fingers crossed).

I also have Hirens Boot CD. Obviously I have no 'system' or boot problems. All I have lost (and it's almost worse) is all my data and flles. Could I - should I - try any other rescue attempt if Recuva doesn't work? This is clearly a major "data recovery" task. I'd appreciate any - sympathetic - help (I'm traumatised!)

[Mark Phelps]

My own experience has been -- Windows apps work best at recovery files from Windows filesystems; Linux apps, from Linux filesystems.

Thus, in Windows, you need to do the following:
1) Download and install this utility on the PC: http://www.majorgeeks.com/news/story/re ... ition.html
2) Connect the external drive
3) Run the data recovery utility to see what can be retrieved from the drive.

If that tool does not find what you need, an alternative is Recuva: http://www.piriform.com/recuva

And, if that does not work well, the best tool out there is this one, but only the trial version is free: http://www.file-recovery.com/

Good Luck

[br1anstorm]

Thanks Mark. In this situation I feel like clutching at any straws! I've been browsing to see what data-recovery programs are available if Recuva (which is still running .....) doesn't do the job. I hadn't seen either of the other two you linked to.

The MajorGeeks Minitool one (Free version) has a 1GB restoration limit, and the other one has a 64KB limit on the trial version. Fair enough - they are both commercial products and maybe count on finding desperate customers willing to pay for rescue. But as most of my docs, and all of my photos, are bigger than that, I need something without those kind of limits.

I've found at least one open source option - Photorec, which comes with TestDisk..... and I've seen other posts on this forum which mention it (it's in the Mint repo and also available as a download for Windows). Might give that a try. Desperate problems call for desperate solutions. Wish me more luck!

[jimallyn]

I have always used (and recommended) TestDisk/PhotoRec.

[all41]

As the external HDD was NTFS

This sounds problematic--my understanding is Timeshift requires linux compatible partitions
such as ext 4 and etc

[Faust]

This was recommended to me but I never got around to testing it

http://www.r-tt.com/free_linux_recovery/Download.shtml

[br1anstorm]

Thanks guys...... just a couple of points on possible ways forward.

My troublesome disk is indeed formatted NTFS (so that both Win7 and Mint could use it). So, Faust, I fear Rtt, which you linked to, isn't much use in this case as it works only on ext formatted drives.

Timeshift is in this context irrelevant. I did run it before all this - and indirectly it was responsible for the current problem as it almost maxed out my storage space (so I deleted the backup I'd made). It cannot now help me.

Mark was, I think, right: since the drive is NTFS, and since it was Windows that corrupted my drive, I'll have to use tools which work with Windows. It looks as if both Recuva and TestDisk/Photorec will do so. I may have to try both....

[catweazel]

This sounds problematic--my understanding is Timeshift requires linux compatible partitions
such as ext 4 and etc

This is correct.

[br1anstorm]

This sounds problematic--my understanding is Timeshift requires linux compatible partitions
such as ext 4 and etc

This is correct.

So saving - and then deleting - my Timeshift snapshot(s) on my external NTFS hard drive was (a) not wise (I was unaware that it had to be on an ext formatted drive); and (b) was almost certainly then responsible for screwing up the attempt by Win7 to defrag that drive - because even though I'd deleted the snapshots, they were still present on the drive in such a way as to throw the defrag off track and render the HDD inaccessible/unreadable.

Hindsight is a wonderful thing.... but my system was fine, and all my data safe, until I ran Timeshift.

[catweazel]

So saving - and then deleting - my Timeshift snapshot(s) on my external NTFS hard drive was (a) not wise

It's certainly true that the current version requires a linux partition, which excludes NTFS. The strange thing is, Timeshift shouldn't have allowed you to use NTFS at all. Are you running Mint 18.3 or some earlier version?

[br1anstorm]

So saving - and then deleting - my Timeshift snapshot(s) on my external NTFS hard drive was (a) not wise

It's certainly true that the current version requires a linux partition, which excludes NTFS. The strange thing is, Timeshift shouldn't have allowed you to use NTFS at all. Are you running Mint 18.3 or some earlier version?

Ah, catweazel, it was a little more complicated than that...

I downloaded Timeshift as a preparation for kernel-upgrade. Never having used it before, I set it running on the defaults. So it started taking snapshots... and saved them on the Mint ext4 partition in my multiboot (Win7, Linux Mint 17.3, Linux Lite) system.

Next day I couldn't boot up Mint at all (and posted a help request on the forum). Long story short, the Timeshift folder full of snapshots (allegedly some 200GB - which seemed weird) had maxed out my Linux Mint partition, rendering Mint unbootable. The other OSs worked fine.

Of the various suggestions offered, I took the advice simply to move the Timeshift folder out of there. So I went into the other Linux system (Lite), and rather than delete the folder, I moved it to the external 1TB drive on which I stored all my docs and files. That external HDD was formatted NTFS so that both Linux and Win7 could access it. Once I freed up the space on the Mint partition, it booted up again just fine.

By then I'd decided to postpone any action to upgrade Mint's kernel, so decided - for the moment - to do without Timeshift (or at least not run it). And I decided to delete the Tmeshift folder full of snapshots off my external HDD. All seemed fine...

BUT..... knowing I'd just saved, and then deleted, a very large folder full of Timeshift snapshots off that drive, and knowing it was NTFS, I thought 'I'll get Win7 to defrag it'.

BIG MISTAKE! The defrag ran for an hour or so then hung. And when I closed down and then rebooted, neither Win7 nor Mint could see/mount the external drive (which the defrag had evidently corrupted). Warning popups suggested running chkdsk /f to sort the problem. I did so (in Win7). It reported the drive error-free, but had evidently in the process deleted all my past 10 years-plus of data.

Hence where we are now and my OP in this thread seeking help over data-recovery. Clearly the defrag process couldn't cope with the presence (albeit deleted) of Timeshift snapshot files on that drive. The whole defrag got derailed, destroying or corrupting the very organised set of folders in which I had saved all my data.

The update and somewhat good news is that Recuva seems able to retrieve much of the data. I say seems, because I'm still working it. The bad news is that - with everything deleted and the folder structure destroyed or screwed, all the files which were on that HDD are in one massive pile. Not just my own docs/pics etc - but, I think - all the stuff that the deleted Timeshift folder must have had in its snapshots of my Mint system.

The paradox is that I had always seen system-crash (Win7 or Linux) or computer failure as the risk, so had saved/stored all my personal data on an external hard drive "for safe keeping". I never imagined that having some Linux files (Timeshift) on an NTFS drive would cause the defrag to wreck it.

I can only compare it to having your house destroyed by an earthquake. The house itself (bricks, glass, tiles, wood) and all the house contents, are still there. But in one massive pile of rubble. So I'm picking through that rubble, trying - literally - to find the family photos and bank records etc..... but also trying to reconstruct the filing cabinets/cupboards etc that contained them. Not a situation I would wish on anyone.

[AugustineAdams]

Believe me, the prerequisite for recovering lost data is that deleted data is not overwritten. Using data recovery tools is the safest and most effective way to recover lost hard drive photos.

[ganamant]

I had saved all my files on to an external drive because I reckoned that was safer, and would preserve the data

I'm sorry to read about what happened. You must have misinterpreted the recommendation you are referring to: you make data safe by having them both on your internal drive and on an external drive, not only on an external drive. Data stored in just one place can't be said to even exist at all.

Since Windows messed up that drive, and it was formatted as NTFS, I would try to use Windows itself to try and recover the data, but be careful not to make things worse by writing anything to that drive. The best strategy would be to get another drive of the same size, clone the original drive onto that, and work on the copy only. You can use dd from within Linux Mint for that:

Code: Select all

sudo dd if=/dev/sdx of=/dev/sdy bs=512k

Make sure both drives are unmounted and substitute x and y with the correct letters. Be extra careful and extra aware as you type those letters. To be clear, x is the source and y is the destination: don't swap them!

dd doesn't care about filesystems at all: it just copies raw data as they come from the volume, corruptions, errors, and all.

[Marie SWE]

Her is two recovery tools I use to rescue lost partitions and files.. also for repairing crashed operating systems.

https://www.hirensbootcd.org/download/

http://www.system-rescue-cd.org/Download/

[br1anstorm]

Thanks to all three forum members who have - a year or so later - picked up on this thread......

It was a traumatic experience, and it took a long time to pick up the pieces. Fortunately I set about the rescue and recovery task straight away so (as AugustineAdams says) the messed-up and "lost" data was not overwritten.

This made the recovery task a little easier. But it still took a long time. As ganamant suggests, I had to work mainly via Windows to get the files back, not least because the external drive was NTFS and because Windows had caused the problem. I relied mainly on Recuva - which by the way I found pretty effective. I did try one or two other apps (PhotoRec was one of them, I forget the others) but Recuva did the job as well as I could have hoped.

The exercise took ages (weeks.... months....). Basically - and already I am forgetting all the painful details - I had to use Recuva to trawl through the borked external drive by file-type, recovering data in stages and saving it on to another drive. So I gradually assembled large folders of .doc, .jpg, .mp3, .odt, .eml and other files. I then had to sift through them and, using the Windows search tool, find and eliminate duplicates (often marked with (1) or (2) etc as they had been found and saved). Once that was done I was able to gradually reinstate my photos, docs, music tracks and other files, most of which had labels, titles or dates which made sorting easier, into new folders.

I still have some residual - but probably not very important - files left on the "Recuva" drive. But as far as I can tell I have not permanently lost anything crucial.

A lesson which I learned the hard way. I confess that although I have now made disk images and backups, I still have not found a single ideal and user-friendly program that runs backups in a way that is easily managed, selectively browsable, and doesn't take up vastly more space than the originals. But with Deja-dup, Timeshift, backup and restore disks, and cloned images, I hope I am better prepared than before if something goes wrong again.

[vansloneker]

brianstorm, consider your self lucky. And congrats on a job well done. It could have been worse.

I stupidly yesterday deleted a 120GB folder from an external drive, remembered this topic, and installed testdisk to recover. It recovered a lot, but also a number of failed appeared, even though nothing had been written to the drive since the incident.
So I cancelled the job. Luckily the drive was just an extra copy to transport the data to another location, so it's just a matter of returning and restoring. All that is lost is the job I was doing is not 100% finished and will have to be later.

I have 7 instances of this important data, a bit over the top but I learned the hard way like brianstorm. Another valuable data set I keep 4 copies off. I frequently sync my backups with FreeFileSync. It does take a lot of time actually to keep it all updated. But I learned the hard way, you never get it back once it is really lost. Now it's just a matter of one disk showing signs of unreliability: change it, but no drama. Although many disks at the same time increase the number of casualties.....

[deepakdeshp]

This sounds problematic--my understanding is Timeshift requires linux compatible partitions
such as ext 4 and etc

This is correct.

NTFS is also Linux compatible

[deepakdeshp]

Thanks to all three forum members who have - a year or so later - picked up on this thread......

It was a traumatic experience, and it took a long time to pick up the pieces. Fortunately I set about the rescue and recovery task straight away so (as AugustineAdams says) the messed-up and "lost" data was not overwritten.

This made the recovery task a little easier. But it still took a long time. As ganamant suggests, I had to work mainly via Windows to get the files back, not least because the external drive was NTFS and because Windows had caused the problem. I relied mainly on Recuva - which by the way I found pretty effective. I did try one or two other apps (PhotoRec was one of them, I forget the others) but Recuva did the job as well as I could have hoped.

The exercise took ages (weeks.... months....). Basically - and already I am forgetting all the painful details - I had to use Recuva to trawl through the borked external drive by file-type, recovering data in stages and saving it on to another drive. So I gradually assembled large folders of .doc, .jpg, .mp3, .odt, .eml and other files. I then had to sift through them and, using the Windows search tool, find and eliminate duplicates (often marked with (1) or (2) etc as they had been found and saved). Once that was done I was able to gradually reinstate my photos, docs, music tracks and other files, most of which had labels, titles or dates which made sorting easier, into new folders.

I still have some residual - but probably not very important - files left on the "Recuva" drive. But as far as I can tell I have not permanently lost anything crucial.

A lesson which I learned the hard way. I confess that although I have now made disk images and backups, I still have not found a single ideal and user-friendly program that runs backups in a way that is easily managed, selectively browsable, and doesn't take up vastly more space than the originals. But with Deja-dup, Timeshift, backup and restore disks, and cloned images, I hope I am better prepared than before if something goes wrong again.

Please give a thought to mirroring your data. I believe that Catweasel has implemented the same

[sanmig]

... I confess that although I have now made disk images and backups, I still have not found a single ideal and user-friendly program that runs backups in a way that is easily managed, selectively browsable, and doesn't take up vastly more space than the originals. But with Deja-dup, Timeshift, backup and restore disks, and cloned images, I hope I am better prepared than before if something goes wrong again.

Thank you for sharing that painful story. It’s late but we can still learn from it. If it can go wrong, it will.
This is why having a single data drive makes me nervous and (I’m a n00b coming from Mac) I have two external HDs connected to my Mac. Time Machine automatically uses both drives, alternating between them, keeping the incremental backups up to date. This would be good if I only haven’t had bad luck with TM: At the beginning I had only one drive, but suddenly, after some months, I couldn’t go back in time any more. Silently TM has lost control and there was no way to get it back accepting the data drive. After several attempts I had to low level format the drive (and it’s still working).

Don’t know if that may happen to two HDs. I did not get any error message with the one drive, why should I get one with two drives?
Now I’m not happy anymore with a permanently connected “safety” drive.

So I use Timeshift in a similar way and it seems to work: My first, permanent TS drive is my second internal HD. Once a month I connect an external drive, select it in TS and create a manual snapshot. The drive is stored in a firesafe place.
Seems to be a fairly simple solution and an improvent to my Mac solution.
I don’t encrypt, though (I’d expect troubles with TS?).
And I think about Grsync

[catweazel]

This sounds problematic--my understanding is Timeshift requires linux compatible partitions
such as ext 4 and etc

This is correct.

NTFS is also Linux compatible

Helloooooo? Anyone home? Timeshift?