[Wolves] NTFS deleted file recovery

[leo sandhu]

Ok, sorry I realise that I have been rather too vague.

This is a loose recollection of my progress so far.

1. I removed the 40Gb NTFS Windows XP disk from service.  This would have
been more successful if my mother could understand that using the pc as a
CDplayer is the same as using the pc.....

2. Using a separate 80Gb disk I installed Knoppix to  ReiserFS partition

3. Using PhotRec, conveniently now part of Knoppix - hence my choice of OS,
salavaged data from NTFS to directory on ReiserFS

4. When using PhotoRec I had specified which file types I actually wanted.
MS Word, PwrPoint, PDF.
PhotoRec apparently recovered 36GB data from 40GB drive.

5. Filtered files based upon type and size.  Began trying to open files.
Realised 99% junk, trying to find the 1% broke my will to live.

6. Ron suggested " file *.* " would check headers and confirm true content.
It only confirmed that the files listed as being .doc were .doc.  For one
second, I do not believe it is giving correct output as some files are
listing as being 500Mb .docs .

7.  At this stage, I think PhotoRec has copied the entire content of the old
drive and allocated a file type to each of the files it handled.  These 3
file types were .doc .pdf . ppt.  It appears to have done this in such a way
that I need more sophistication than " file *.* " can provide...



On 10/16/06, James Turner <james at turnersoft.co.uk> wrote:
>
> On Sunday 15 October 2006 23:36, leo sandhu wrote:
> > It's not worked :(   I have already seperated all the files into
> seperate
> > directories based upon size and the alleged extension.  Running *.* is
> > simply  confirming  that the files are sorted correctly :S
>
> In what way hasn't it worked? Mounting the disc or running file on it? You
> should get output like:
>
> $ mount /dev/hda1 /mnt -t ntfs -o ro
> $ cd "/mnt/Documents And Settings/Leo Sandhu"
> $ file *
> antena1wheel_1.mpg:      MPEG sequence, v1, system multiplex
> dotnet-debate.txt:       ASCII English text
> intranet-sevices.xcf:    GIMP XCF image data, version 0, 243 x 28, RGB
> Color
> overtime.xls:            Microsoft Excel Worksheet
> salary-scale-2004.doc:   Microsoft Office Document
> Sheet Music:             directory
> usbplug.gif:             GIF image data, version 87a, 317 x 247
> workspace:               directory
>
> (where $ represents the shell prompt)
>
> The type information is determined based on file contents - the filename
> extension is ignored. If everything just shows up as "data" (a bad sign)
> then
> try looking at some of the files (preferably the smaller ones) with
> "hexedit <filename>" (assuming this command is available in the Ubuntu
> Live CD
> or whatever you decide to use) and seeing if anything looks intelligable.
>
> Some specific notes:
>
> - OpenOffice.org documents are saved as ZIP files containing the elements
> of
>    the document in XML format, so show up as "Zip archive data, at least
> v2.0
>    to extract". Similarly, KOffice documents and Dia diagrams both show up
> as
>    "gzip compressed data, from Unix".
>
> - Microsoft Office documents seem to show up as either "Microsoft Office
>    Document" or as the individual application name, not always
> consistently
>    for a given extension. Presumably this depends on which variant of the
>    format was used when the file was saved.
>
> Regards,
>
> James
>
> _______________________________________________
> Wolves LUG mailing list
> Homepage: http://www.wolveslug.org.uk/
> Mailing list: Wolves at mailman.lug.org.uk
> Mailing list home: https://mailman.lug.org.uk/mailman/listinfo/wolves
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.lug.org.uk/pipermail/wolves/attachments/20061016/0e4843d1/attachment.html