1

Should I use dd or similar before I use testdisk? I reformatted an ntfs partition and would like to recover some of the data. I am using live ubuntu. Also is testdisk good for this type of job? Thank you in advance.

My question is different from this because that doesn't say if you should clone the drive before using testdisk.

zxxz135
  • 11
  • oh sorry I will add it. – zxxz135 Sep 17 '18 at 17:43
  • If your drive is not dying you can safely proceed as outlined in my answer to a similar question. No need to work on a clone (this however is recommended if your disk has errors). – Takkat Sep 17 '18 at 18:13
  • Welcome to AskUbuntu! If I were in your shoes and the data was important to me, I would certainly use dd and work from an image. It is however crucial that you don't mix up your source and target as dd will happily do whatever you ask, even if you ask it to do something very wrong. testdisk is well suited for recovering a formatted NTFS partition. – Elder Geek Sep 18 '18 at 22:05

1 Answers1

1

and welcome to Stack Overflow. I hope we don't take up too much of your time.

As for your issue - this is just a recommendation, and this is purely based on my opinion: gddrescue or GNU ddrescue (ddrescue). It clones items, but with a -v or -vv it gives good indications about where it is in the recovery process and is very configurable in its options (such as bad skip amount, read direction, direct v. indirect reading, and things of that nature).

Before I can give you the command line to use it, I need to know:

  1. Were you planning on backing up the item to another physical disk (/dev/sdc) or as an image on a filesystem?
  2. Are you backing up the whole disk as an image? (e.g. /dev/sda )
  3. If 1 & 2 , Are you familiar with using loop + offsets to mount a partition in the whole disk image?
  4. If you are doing a straight copy, I'll assume that the target is larger than the destination, right? There's some oddness with the way that certain manufacturer's label disk sizes, so keep that in mind (GB = 1000^3 instead of GiB 1024^3 - GiB are bigger)

I'll update this as you get back with me, as the recommendations I give will be based on what you tell me. Even if you were using just dd, the top 4 questions would still apply.

Be aware that dd is sometimes referred to as "destructively duplicate" or "dangerously duplicate", and ddrescue is derived from dd. If you confuse input and output, it is possible to completely destroy what you are trying to save.

Be careful!

edit 1:

If you believe that the partition was deleted or has some otherwise user-injected corruption, rather than device injected, the safe route is to duplicate the device first. Then duplicate the duplicate. Then run your tests on the third generation copy, whether it be testdisk for partition recovery/repair, or photorec to recover lost photos from the partition. That way, if things are hopelessly scrambled, you can just go back a generation and duplicate that and try again. I recommend refraining from running testdisk on the master copy (unless one of the copies responded positively to your probes, and you could verify the items enclosed weren't corrupted).

If the partition was BitLocker or LUKS encrypted, you may have an uphill battle in front of you. Best of luck.

The Dude
  • 404
  • 2
  • 7
  • it wan an ntfs partition that had win 10 on it. I accidentally formatted it and would like to recover some of the data that was on the desktop. It was a quick format if that helps. Thank you for your time. – zxxz135 Sep 17 '18 at 18:47
  • @zxxz135 I recommend a backup. However, if you don't have the time or the storage capacity to do that, you can go straight to testdisk to recover. IIRC, there is a way to back up the partition table you're trying to repair. (It's small, so any smallish thumb drive will do) I've been in the same boat, I can empathize. Someone has suggested a similar topic: I'd look there. I wish you the best. – The Dude Sep 17 '18 at 20:16