Data Recovery on NTFS Partition Using Ubuntu 12 (x86)

[jyorkcar]

Hi,

I'm trying to recover an accidently "formatted partition," using the Ubuntu operating system. I have already created an image of the partition using "ddrescue" commands and now I need to be able to mount the image to view the files. How do I perform this next step? I am getting various errors when I run "ntfsck -n imagefile" For example, I get several errors like so, "ntfs_mst_post_read_fixup_warn: magic."

Background info:

The drive is 250GB, which is composed of several partitions; a 100GB partition of which has my customized Windows 7 installation that I am trying to recover. I was actually in the process of upgrading my computer from HDD to SSD and somewhere along the way the drive in question gave me errors about needing to run chkdsk from Windows, but that failed with some error about not being able to write the log file. I somehow stumbled upon a recovery partition, began to run it thinking it would fix my problem, but apparently this is where the accidental formatting occurred. I have run a program called EaseUS on the drive, which shows some of my files are still present on the partition, but I am unable to recover anything without paying some fee (which I cannot afford).

Additional:

I am new to Ubuntu and still learning how to use the various commands. So please bare with me.

Some Technical Details:

eee@eee-1015PN:/media/eee/WD-Green1/linuxrecov$ sudo ntfsfix -n imagefile
Mounting volume... ntfs_mst_post_read_fixup_warn: magic: 0xa67da1e6 size: 1024 usa_ofs: 13558 usa_count: 12683: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x57452840 size: 1024 usa_ofs: 16329 usa_count: 13544: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0xbe6dd42c size: 1024 usa_ofs: 8252 usa_count: 2010: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x92d5f951 size: 1024 usa_ofs: 30892 usa_count: 37627: Invalid argument
$MFTMirr does not match $MFT (record 0).
FAILED
Attempting to correct errors...
Processing $MFT and $MFTMirr...
Reading $MFT... OK
Reading $MFTMirr... ntfs_mst_post_read_fixup_warn: magic: 0xa67da1e6 size: 1024 usa_ofs: 13558 usa_count: 12683: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x57452840 size: 1024 usa_ofs: 16329 usa_count: 13544: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0xbe6dd42c size: 1024 usa_ofs: 8252 usa_count: 2010: Invalid argument
ntfs_mst_post_read_fixup_warn: magic: 0x92d5f951 size: 1024 usa_ofs: 30892 usa_count: 37627: Invalid argument
OK
Comparing $MFTMirr to $MFT... FAILED
Correcting differences in $MFTMirr record 0...OK
FAILED
$MFTMirr error: Invalid mft record for $MFTMirr.
Corrupted file $UpCase
Setting required flags on partition... OK
Going to empty the journal ($LogFile)... OK
No change made
eee@eee-1015PN:/media/eee/WD-Green1/linuxrecov$ sudo fdisk -l imagefile

Disk imagefile: 107.4 GB, 107374182400 bytes
255 heads, 63 sectors/track, 13054 cylinders, total 209715200 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6e697373

This doesn't look like a partition table
Probably you selected the wrong device.

Device Boot Start End Blocks Id System
imagefile1 ? 1936269394 3772285809 918008208 4f QNX4.x 3rd part
imagefile2 ? 1917848077 2462285169 272218546+ 73 Unknown
imagefile3 ? 1818575915 2362751050 272087568 2b Unknown
imagefile4 ? 2844524554 2844579527 27487 61 SpeedStor

Partition table entries are not in disk order

[oz]

Hello and welcome!

I don't run Ubuntu so can't offer much help with using it, but TestDisk is generally one of the most recommended apps for partition/data recovery:

TestDisk - CGSecurity

Have you tried using it to recover your partitions? Note that it's best to run it from a liveCD such as Parted Magic, and user documentation can be found on the above website.

[jyorkcar]

I tried using TestDisk without success and I don't understand it. It lists about a 100 partitions, including ext4 and Linux even though this disk never had the Linux operating system installed. Also, it says it can't recover my NTFS partition neither does it show me the files I need recovered.

[oz]

I tried using TestDisk without success and I don't understand it. It lists about a 100 partitions, including ext4 and Linux even though this disk never had the Linux operating system installed. Also, it says it can't recover my NTFS partition neither does it show me the files I need recovered.

If there is a workaround using Ubuntu, maybe someone that knows how to do it will reply with some tips for you. I'm afraid that if TestDisk can't do it, you might be out of luck, but hopefully that won't be the case.

There is another recovery tool called Foremost, but I've never used it:

Foremost

There are some tips for data recovery (including a mention of TestDisk, Foremost, and others) that might help you at the Ubuntu website:

https://help.ubuntu.com/community/DataRecovery

[Syndacate]

Since you're in Ubuntu, check out ubuntuforums.org. They can probably give you some good pointers, there.