Recovered Files with TestDisk, but File Names and Folder Structure is Bad

Question

I used TestDisk to recover files from an internal hard drive which I connected externally to another PC. With PhotoRec all the file names are wrong and the original folder structure doesn't exist.

What can be done?

Solution 1

Photorec does do that, its one of the more annoying things about it, but its meant to recover files in scenarios where its more important to get the data.It often is able to rebuild images from fragments in situation where commercial software can't. As such i tend to run recurva first (it preserves filenames) THEN testdisk in a recover scenario. (practically its "Load in another OS with a different file system driver implementation - windows for ext, linux for ntfs, testdisk, recurva then photorec)

You can't recover the folder structure, but you may be able to rebuild the filenames off other data. There's a section on photorec's documentation that has some scripts that are useful for doing this sort of recovery, using exif and other metadata.

Solution 2

One thing I personally took upon myself is to collaborate with the author of photorec to find PAR2 files. He got right on it and added PAR2, but you have to set photorec to recover incomplete files for PAR2 because you'll want to get as much of the file as possible, rather than having it ignore the file if there is a filesize mismatch. If you pre-emptively create PAR2 data, even just 1% of recovery data, with small recovery blocks, spread out over 10 files for an entire directory of files, you'll have just added an enormous advantage to recovering your date, contiguous and fragmented, and the filenames and directory structures, if you're able to recover some of those PAR2 files with Photorec. (or whatever data recovery/file carving software). This works best for media/read many, write not-so-often drives, where you can easily defrag, and not have to worry much updating PAR2 Data.

This won't help your current situation most likely, but I would try programs like "Recuva" which is free, and two commercial programs, "Easy Recovery Pro" and "Zero Assumption data recovery" are some excellent programs to help you recover data. Be careful not to write to the disk until you have made a nice mountable image of the disk with testdisk that you can play with. Depending on the problem, it may be as simple as restoring a backup copy of the file allocation table, or using one of several partition utilities to do a "recover partition" on the damaged drive.

PhotoRec is another beast. While Testdisk can often outright "unedelete" or restore entire partitions or File allocation Tables for various file systems, it doesn't actually do any "searching" for files. PhotoRec combs every sector and/or cluster the hard drive looking for headers of filetypes it it has it it's database, to try to find various filetypes, but it ignores the Filesystem. So you could be using NTFS to nearly any flavor of Linux filesystem and get pretty much the same results. Only problem is, if you use compression in your filesystem, like NTFS compression, or BTRFS compression, or whatever, it will not be able to find those lost files. Your best luck us to try to reconstruct the filesystem in that case. But the files it DOES fine, it has no reference from which to name the files, since it is doing a bare-metal search for data, independent of the filesystem which kept track of all the metadata such as filenames, the locations of files, etc..

You can try and rename files based on metadata recovered from within files, such as JPEGs, or other media. Future approaches, I would heavily recommend adding PAR2 data. MultiPAR or a recent build of Par2CMDLine is highly recommended as they both support recursive subdirectories when building PAR2 data. It's good to build around 10% recovery data, drive space pending. And to refresh the PAR2 data monthly or weekly at least. But it's well worth it. Also, An excellent idea to keep your drives defragmented so your files are contiguous and much more likely to be recoverable if a filesystem failure occurs.

If a filesystem occurs, you can use TestDisk to make a DD file and recover the data from the .DD file rather easily using the PAR2 files extracted using PhotoRec.

Addition: Please forgive the late reply and my terrible composition style. Here are some links that may be of use. Most of the software titles I have mentioned are easily found via. Google search as well.

Addition: Another method might be to use TestDisk to make a raw .dd file of your hard drive to another hard drive, then using a disk mounting utility such as OSFMount, and mount the image as a virtual drive. There are a few utilities which will let you mount disk images as virtual drives, and even read-write to them is if they were actual hardware devices. OSFMount, is just both free and effective for forensic data recovery. The website states the following about OSFmount, "OSFMount is a free utility designed for use with PassMark OSForensics™, "OSFMount allows you to mount local disk image files (bit-for-bit copies of a disk partition) in Windows with a drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the mounted volume's drive letter." You can download the 32bit or 64bit versions for Windows here: http://www.osforensics.com/tools/mount-disk-images.html

Once you have your drive image made, and mounted to an image, you can to risk-free recovery attempts on the virtual drive image. There are many data/partition recovery software available. One good place to start would be with EaseUS Partition Master Home/Free Edition. But it is just as easy to find by doing a Google search for "EaseUS Partition Master Free" Again this is one of many similar tools, but it's free and it's quite effective when it comes to reconstructing a damaged partition and recovering files, even those which have been compressed using NTFS compression.

Comments

[Tamara Wijsman]

Data that can't be recovered, can't be recovered.

[Thalys]

His issue probably isn't with data being recovered, its probably with carving and selecting data since testdisk takes a naive/aggressive approach to file recovery. It tends to ignore the filesystem and just collect and reassemble chunks of image data.

[Joel Coehoorn]

superuser.com/questions/238360/…

[Sidhi Ciang]

agree with you, test disk and photorec need to make easier for recovering files with its file structure and file names.

[Joel Coehoorn]

Pandora Recovery will preserve folder structure.

[Supra]

Ok thanks. I'm not so techsavvy. Windows 7 doesn't recognize the external harddrive. So I cannot select it with Recurva. It does show up in Testdisk though. What should I do?

[Supra]

In Computer Management -> Storage -> Disk Management it says "Disk 2 Unallocated".

[Thalys]

see if the disk can be read on linux, then run through the testdisk walkthrough. Most windows only recovery software won't work in that scenario

[Supra]

Sorry I don't have Linux.

[slm]

Hi and Welcome to Super User! Please read the How to Answer a Question Guide. Could you add some links to the things you reference in your answer? Also try breaking it up, it's a little tough to read.

[Breno Macena]

@slm Seems like Tim Omaha joined just to answer this question. Too bas he hasn't replied. It'd be nice to get more info on PAR2 files. Never heard of it before.

[slm]

@trusktr - yes, given it's been over 6 months I wouldn't expect any. If you're interested in fleshing out the answer more with links etc. feel free, you can make the edits as suggested edits and they'll get approved, and become part of the answer.

[Sidhi Ciang]

@ Joel Coehoorn : can it works for corrupted SDCard ?

[Tim Omaha]

Parchive: Aged page will PAR software and information. Software is dated but may still be of use for information. parchive.sourceforge.net

[Tim Omaha]

QuickPar: Was the first real PAR2 program that made it easy to make PAR2 files, and then use them later to "carve" the data out of a something like, a raw drive image, and also recover any additional PAR2 data from the set from that lump of data and use it to further aid in data recovery. QuickPar, unfortunately does NOT support saving or reconstruction of directory structures, only filenames. It is also somewhat dated, as it seems to be abandoned since 2004. quickpar.org.uk

[Tim Omaha]

MultiPar: The only "PAR" software under active development of which I'm aware. The developer has been working on a new PAR3 specification, which is more efficient and faster than PAR2, but has been in perpetual unstable development. However MultiPar does an excellent job supporting PAR1 and PAR2. MultiPar DOES support Subdirectory and Filename information, but unlike QuickPar, you cannot just hand it a lump of data, such as a drive image, and have it search through it to recover data or additional PAR2 data that may be part of the set for recovery.

[Tim Omaha]

MultiPar seems to have two sites. One I know is the legitimate author's website: hp.vector.co.jp/authors/VA021385 And the other I am not sure, multipar.eu

[Tim Omaha]

Current best practice is to use both MultiPar and QuickPar if needed. Create PAR2 data of a directory structure with MultiPar. Make a copy of the PAR2 data to another drive or DVD. If your drive becomes corrupt, (Virus, Corruption of MFT, FAT, Partition, etc) make a raw drive. You can use PhotoRec, to attempt to carve out some PAR2 data and use those for data recovery, or use your backups. Use QuickPar to recover the data from a given PAR2 set, then use MultiPar again on the recovered data to recover the directories and sort the files into the proper directories.

[Tim Omaha]

As always, regardless of your OS, do your best to make sure the data on your drives is defragmented/contiguous not only to maximize your drive performance, but most importantly, to maximize your ability to recover your data. Fragmented data drastically reduces your ability to recover your data, though the PAR2 files can help in cases where only partial recovery or corrupt files would otherwise be the result of a recovery attempt.