Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So have this problem. Have a 500G disk with data that has crashed. I need to recover data. I used ddrescue to first create an image and I have recovered 455G to that image. Now, I do not know what the fs of the original disk was (it was linux and mounting the saved image using ext2/3 gives a bad fs error). So when I use a tool like photorec to recover the data, all the recovered files are renamed and somewhat useless to me -- my data files had specific names.

The disk in hosted somewhere else and I do not have physical access. So what can I do?

I used ddrescue from position 300M as I suspect the problem was in the first 200M or so. Anyway I can recover some useful fs info using ddrescue that would enable me to reconstruct a better part of the file system from the saved image?

Thanks!

share|improve this question
add comment

3 Answers 3

File names are not actually stored with the files. File names are stored in a table at the start of the disk called the Master File Table (MFT) it is possible that the MFT has been destroyed or corrupted and can no longer be readable when your harddisk was crash and i guess you cannot get that filename back..

share|improve this answer
    
Well, if I remember MFT is only for NTFS? I do not know what the underlying FS is but it is not NTFS.. –  Kid_A Jun 15 '12 at 12:28
    
A similar principle applies to most filesystems though. Directories are usually actually special FILES that have in them a list of file names vs an internal identifier (inode number in unix style filesystems) that references yet another list mapping files to disk blocks. The reason most OS do not let you treat directories as normal files (some unices do IIRC!) even with root rights is that accidentally deleting it would leave the files that were referenced in it on disk taking up space but at the same time inaccessible. –  rackandboneman Jun 15 '12 at 13:57
add comment

UFS Explorer is a great tool for this type of recovery. It may help associate names in your case, but i've used it numerous times for tough data corruption and undelete situations.

share|improve this answer
    
Thanks! Will try. Would upvote but don't have enough reputation :( –  Kid_A Jun 15 '12 at 13:36
add comment

http://www.cgsecurity.org/wiki/TestDisk is your friend

share|improve this answer
    
Well am using that. Problem is, the file names are not preserved... –  Kid_A Jun 15 '12 at 13:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.