Recovering broken or deleted NTFS partitions
Disclaimer: I provided an answer to similar questions here and here. This is a summary of those two answers. Moreover, I am the developer of RecuperaBit.
Your NTFS partition is broken. In order to restore the data, you need to make a copy of it (ideally) and then use a NTFS reconstruction software to restore its contents.
Clone the drive
You really should clone the drive in a file on an external disk, unless it is so big you can't find another drive than can contain it.
If you are really sure the NTFS partition coincides with /dev/sdb2
, then use ddrescue
to copy only that one:
sudo ddrescue /dev/sdb2 /media/user/External/copy.img /media/user/External/status.log
If you are not sure, it is much better to clone the entire /dev/sdb
drive. This will take more space, of course:
sudo ddrescue /dev/sdb /media/user/External/copy.img /media/user/External/status.log
The status.log
file is not mandatory, but it is needed if you want to pause the process and resume later on.
Analyze and reconstruct the file system
If the file system is only slightly broken, you may have luck with testdisk
:
testdisk /media/External/copy.img
Follow the step-by-step procedure in the CLI and you will be able to list the contents of the partition with the P
key, assuming it is almost intact.
If the damage is more serious, you need something else. You can recover (possibly severely) damaged NTFS partitions using RecuperaBit. RecuperaBit attempts to reconstruct file system structures and recover files. RecuperaBit attempts reconstruction of the directory structure regardless of:
- missing partition table
- unknown partition boundaries
- partially-overwritten metadata
- quick format
Currently, it does not require installation, you need to download the archive from GitHub and extract it in a directory of your choice.
After that, create a directory for the output and start the program with:
mkdir /media/user/External/recovered_files
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save
You might also use python
, however pypy
is faster. The scanning process will take quite some time. When it's done, type recoverable
and find the id of your partition. If it is e.g. 2, type:
restore 2 5
restore 2 -1
5
means the Root directory and -1
means the Lost Files directory.
For additional details, explanations and caveats, see the two links at the top of this post.
Related videos on Youtube
Notbeginner Norexpert
Updated on September 18, 2022Comments
-
Notbeginner Norexpert over 1 year
About two weeks ago I had a problem with my PC that my brother wrote a question about at PC not booting after using Windows 7 auto-repair.
I still haven't solved the problem, so my PC is unusable now.
Now I think that it would be simpler to re-install both Win7 & Ubuntu than repair them, but there're some data on their partitions. I want to recover this data.
These partitions are not mountable for some reason. I don't know why.
sudo fdisk -l
about the problematic partitions:Device Boot Start End Blocks Id System /dev/sda1 2048 147912703 73955328 83 Linux /dev/sdb2 206848 174079999 86936576 7 HPFS/NTFS/exFAT
And in GParted:
And the error of the
mount
command:Failed to mount '/dev/sdb2': Invalid argument The device '/dev/sdb2' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
And the exact same message for
/dev/sda1
How can I recover my data from those HDDs?
EDIT
I have tried to specify the type of the drive:
$ sudo mount -t ext4 /dev/sda1 /olddisk mount: wrong fs type, bad option, bad superblock on /dev/sda1, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so $ sudo mount -t ntfs /dev/sdb2 /olddisk NTFS signature is missing. Failed to mount '/dev/sdb2': Invalid argument The device '/dev/sdb2' doesn't seem to have a valid NTFS. Maybe the wrong device is used? Or the whole disk instead of a partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?
EDIT
sudo ntfsfix /dev/sdb2
returns:Mounting volume... NTFS signature is missing. FAILED Attempting to correct errors... NTFS signature is missing. FAILED Failed to startup volume: Invalid argument NTFS signature is missing. Trying the alternate boot sector Unrecoverable error Volume is corrupt. You should run chkdsk.
-
Admin almost 8 yearsIf you are sure sda2 is NTFS, use ntfs-3g as type. if it doesn't work, it means your file system needs to be ckecked
-
Admin almost 8 years@MostafaAhangarha I think it's NTFS becouse that's the partition of WIN7. I got the same error with
-t ntfs-3g
. -
Admin almost 8 years@NotbeginnerNorexpert sorry, I now saw your pictures and I am a bit confused. In your question you wrote about
sdb2
but the picture shows that alsosdb5
is a NTFS partition. Which one are you trying to access?
-
-
Notbeginner Norexpert almost 8 yearsThx for Your help! I'm currently working on recovering the Ubuntu's filesystem, but after that I'll try what you wrote.
-
Andrea Lazzarotto almost 8 years@Notbeginner Norexpert: If my answer was helpful to you, then please consider marking it as the accepted answer so others may more easily find it in the future. This is also a polite way to thank the person answering your question for helping you out.
-
user.dz over 7 years@NotbeginnerNorexpert, Did it work for you? So I could more confident to point the users this post because it really a hard topic.