Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So have this problem. Have a 500G disk with data that has crashed. I need to recover the data. I used ddrescue to first create an image and I have recovered 455G to that image. Now, I do not know what the fs of the original disk was (it was linux and mounting the saved image using ext2/3 gives a bad fs error). So when I use a tool like photorec to recover the data, all the recovered files are renamed and somewhat useless to me -- my data files had specific names.

The disk in hosted somewhere else and I do not have physical access. So what can I do?

I used ddrescue from position 300M as I suspect the problem was in the first 200M or so. Anyway I can recover some useful fs info using ddrescue that would enable me to reconstruct a better part of the file system from the saved image?


locked by HopelessN00b Feb 18 '15 at 12:58

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Feb 18 '15 at 12:58

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – HopelessN00b
If this question can be reworded to fit the rules in the help center, please edit the question.

File names are not actually stored with the files. File names are stored in a table at the start of the disk called the Master File Table (MFT) it is possible that the MFT has been destroyed or corrupted and can no longer be readable when your harddisk was crash and i guess you cannot get that filename back..

Well, if I remember MFT is only for NTFS? I do not know what the underlying FS is but it is not NTFS.. – Kid_A Jun 15 '12 at 12:28
A similar principle applies to most filesystems though. Directories are usually actually special FILES that have in them a list of file names vs an internal identifier (inode number in unix style filesystems) that references yet another list mapping files to disk blocks. The reason most OS do not let you treat directories as normal files (some unices do IIRC!) even with root rights is that accidentally deleting it would leave the files that were referenced in it on disk taking up space but at the same time inaccessible. – rackandboneman Jun 15 '12 at 13:57

UFS Explorer is a great tool for this type of recovery. It may help associate names in your case, but i've used it numerous times for tough data corruption and undelete situations.

Thanks! Will try. Would upvote but don't have enough reputation :( – Kid_A Jun 15 '12 at 13:36 is your friend

Well am using that. Problem is, the file names are not preserved... – Kid_A Jun 15 '12 at 13:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.