0

So there's the problem: I wanted to create a bootable USB from an ISO image BUT I accidentally I did that one on my external hard disks instead of the usb. Now that drive is 2TB and it was full of picture, files etc. I would like to recover as much as possible from that. Since I'm pretty a n00b with Ubuntu I'm trying to figure out how to use Testdisk (which I've heard it's a very good tool for data recovery).
Questions:

  1. is it not possible just to unmount the iso in order to get again access to the other files? Does the mounting "formats" in some ways the rest of the drive?
  2. Testdisk asked me to specify the partition table type, what is and what I should answer?
  3. There are other possible ways to recover the data? I mean, nothing was "really" formatted and also the iso is not big enough to mess everything up.

Sorry if those questions are out of topic of not so detailed, and thanks for any possible answer.

3
  • I voted to close this question with reason: "unclear what you're asking". You say "unmount", "nothing was really formatted" -- and this makes me wonder what exactly happened. What exact command or tool did you use? Was it dd? I think the question is also too broad. Your three questions are, well, three distinct questions. Commented Sep 27, 2017 at 12:41
  • I understand. Well I'm not so good explaining this kind of stuff. Yes I used the dd comand to mount the iso on the drive. And I was wondering if after that the drive was completely formatted or what. I'm not an informatician that's why I'm seeking help and suggestion.
    – Bretha
    Commented Sep 27, 2017 at 21:46
  • See also this answer: superuser.com/a/1144489/278831 Commented Sep 29, 2017 at 8:36

1 Answer 1

0

You probably don't want test disk in the first instance, you want photorec which is part of the test disk suite. (Photorec is easy to use for a start)

Photorec will ignore the disk format and look for what it can recover regardless of filesystem. Unfortunately this means it will loose filenames, files which have been fragmented and files without a recognisable sig - and it will find old deleted versions of files you want).

Testdisk is more advanced and serves a different purpose. Before you use it you should clone the disk so if you stuff up you can try again. Testdisk is designed to handle lost stuffed up partitions with in-tact filesystems. Sometimes, depending on the Filesystem you can get lucky and partially recover from a backup file table structure. This is quite complex and filesystem dependant.

If the disk was used in Windows it is most likely formatted with a version of the FAT filesystem or NTFS. There are different numbers associated with these, but we can't advise without knowing more. That said, it's probably academic in light of your skill level. If the disk was a typical external drive with 1 large partition, writing Ubuntu would have overwritten the first part of the disk - the part which holds the file allocation table or equivalent.

5
  • It puzzles me why one would want to use a carver in the first place and lose access to fragmented files, the whole directory structure and any file type that Photorec does not recognize. A file carver is the last resort, not the first thing to use. Commented Sep 29, 2017 at 8:33
  • @ndrealazzotto For you and me yes, but for someone who does not know the basics? Also, Testdisk does not have this functionality. Also - do you know if it's possible to rebuild data off a FAT system which is missing the first gig or 3? BTW, I'm genuinely impressed with your knowledge of NTFS (as per your other post)
    – davidgo
    Commented Sep 29, 2017 at 8:56
  • @AndreaLazzarotto What do you mean by "carver" and what you suggest to use instead? @ davidgo I launched successfully Photorec ( or hope so at least), let's see the result. If I can collect again almost all the files is fine even if I have to check them all one by one and rename them.
    – Bretha
    Commented Sep 29, 2017 at 9:02
  • @davidgo, thank you. I just realized that OP did not mention what file system was on the drive. I assumed NTFS but it seems you answered for FAT. Fair enough then. :) Commented Sep 30, 2017 at 11:18
  • @Bretha, I already talked about carvers and NTFS reconstruction in the answer I linked in my comment under your question. Commented Sep 30, 2017 at 11:19

Not the answer you're looking for? Browse other questions tagged .