0

I have permanently deleted a folder by manually pressing the delete key on my external hard drive and realised not much later that I still need the data in that folder.

I immediately turned off my HardDrive and thought about the options I have for recovering the data. Because I worked on that HardDrive (sorting through files etc.) there are many deleted files and folders. I am very sure that I only need one folder back.

photorec will recover all the deleted files, but I can't chose which one, and to be honest, it's a mess searching through 40 GB+ of files to find the few I actually need. To make things a bit more complicated, the HardDrive's filesystem is HFS+.

Free-Trial Data Recovery applications have showed said deleted folder and listed the correct folder size, but require payment in some way to actually recover this folder.

Is there a - preferably free - method to recover only chosen files from an external HardDrive? I

Narusan
  • 103
  • 1
    How did you delete the folder? What's the file system type on the drive in question? – David Foerster Sep 10 '17 at 12:27
  • @DavidFoerster Manually deleted them by pressing the delete key, and the file system is hfs+ – Narusan Sep 10 '17 at 12:33
  • One of better tools to recover deleted files is foremost (https://www.howtoforge.com/recover-deleted-files-with-foremost). Look at this: https://askubuntu.com/questions/3883/how-to-recover-deleted-files – Redbob Sep 10 '17 at 12:44
  • @Redbob What are the advantages of foremost? The last time I googled it, it supported way less file formats than photorec, didn't have a progress bar and was entirely based on input, while photorec does have a Terminal interface. – Narusan Sep 10 '17 at 14:33
  • I fell Foremost is better, based in results. But we are free to find others. https://wiki.archlinux.org/index.php/file_recovery – Redbob Sep 10 '17 at 14:45
  • Why did you try photorec rather than its cousin testdisk? – Andrea Lazzarotto Sep 11 '17 at 23:14
  • @AndreaLazzarotto Because testdisk doesn't work with HFS+. – Narusan Sep 12 '17 at 04:53

1 Answers1

1

Linux has mediocre HFS+ support: the open-source kernel module defaults to read-only mode because write support is considered unstable (and thus potentially destructive).

The situation is even worse for integrity checks and recovery. You should use the tools that Apple provides for its home-grown file system or commercial tools that specialise in HFS+ undeletion or data recovery. These should give you better chances of success for file undeletion than Photorec. The former leaves traces behind that allow a complete and easy recovery if the freed blocks weren't reclaimed while the latter looks for known content type patterns in arbitrary blocks of data (that may or may not contain a valid file system).

David Foerster
  • 36,264
  • 56
  • 94
  • 147