6

The first 7GB of a 500GB NTFS partiton was accidentally overwritten with another file. Is it possible to recover some of the data in the remaining 493 GB of the NTFS volume? The partition table is intact. The executed command was:

dd if=file of=/dev/sdc1

Thanks

Edit: My question is different. I overwrite first 7GB of NTFS partition. Other question mostly deals with hardware failures or bad sectors.

Improve this question
3

3 Answers 3

Reset to default
7

SOLUTION: None of suggested solutions worked for my case. I partly solved my problem with RecuperaBit. RecuperaBit could recover a lot of small files, including important ones. But it failed to recover big (bigger than 1 GB) files.

In my opinion, only RecuperaBit solution should be advised such (beginning of NTFS volume overwritten) cases.

Thanks to everyone answered and tried to find a solution for me.

Improve this answer
1
  • There is no hardcoded limit on file size. Most likely your file had NTFS compression enabled.
    – Andrea Lazzarotto
    Commented Nov 25, 2016 at 17:10
2

On linux you can recover all the files in the not overwritten part with https://help.ubuntu.com/community/DataRecovery/NtfsUndelete

There are also similar tools for windows.

Very important is, that you do not write anymore to the disk, also restore the files to another disk. Otherwise you limit your chances of success.

Improve this answer
5
  • ntfsundelete gave me this error: # ntfsundelete /dev/sdc1 NTFS signature is missing. Failed to mount '/dev/sdc1': Invalid argument The device '/dev/sdc1' doesn't have a valid NTFS. Maybe you selected the wrong device? Or the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around?
    – coolman
    Commented Nov 16, 2016 at 21:53
  • This tool cannot work if the file system is damaged. You can e.g. use RecuperaBit which I developed for that purpose.
    – Andrea Lazzarotto
    Commented Nov 18, 2016 at 1:06
  • @AndreaLazzarotto thank you for developing RecuperaBit. I can recovered a lot of valuable data with it. On the other hand it cannot recover big files. It shows big files name but file size as 0. Is there any way to recover big files? Thanks
    – coolman
    Commented Nov 25, 2016 at 16:42
  • @coolman There is no limitation on the file size you can recover. It doesn't work if NTFS compression is enabled, but that's clearly written in the warnings when running the program. Also, NTFS compression is disabled by default on every version of Windows.
    – Andrea Lazzarotto
    Commented Nov 25, 2016 at 17:09
  • For large files the possibility, that one of the sectors in which the file was stored is overwritten is much higher. Thats why you are able to recover many small files, but less likely to succeed with big ones.
    – edlerd
    Commented Nov 26, 2016 at 9:31
1

You would have to use a program like TestDisk to undelete files from your NTFS partition. EDIT: Although if you have a native program installed, as mentioned by edlerd, you may want to go with that instead

It's hard to say what data will or won't be available to you, but as long as you didn't overwrite all of it, I think you should be able to find some stuff.

Disclaimer: I haven't used TestDisk myself. It was the first result when I Googled "linux tool recover deleted partition". I have used similar tools in the past, however - you may want to shop around and see which you trust the most/find the most comfortable to use.

Improve this answer
1
  • This won't work if parts of the MFT are damaged.
    – Andrea Lazzarotto
    Commented Nov 18, 2016 at 1:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .