Find the answer to your Linux question:
Results 1 to 8 of 8
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1

    Ext4 Data Recovery Question

    Hi guys,

    Couldn't find an answer to this specific problem. I had an ext4 hard drive that worked wonderfully with Debian. I plugged it into my wife's Windows Vista in order to back up her photos. Windows gave me a message, and for the life of me I can't remember exactly what it was. It basically indicated that the drive could not be read, and it wanted to do something, like add an index to the drive. It definitely didn't say it wanted to format the drive or anything. The way it was phrased made it seem, to me, like it wasn't that big a deal. And doing a quick search on it, it seemed like it would be okay. So I did that and Windows said it still couldn't read the drive. So I stopped. The next day, plugging it back into my own computer, and Debian couldn't read it either. I tried a couple command-line tools in linux to see if I could get it to work and I couldn't. I took it to a local computer repair shop and they said they couldn't recover the data either. The next step, in their opinion, was to send it off to some crazy recovery place that costs thousands of dollars. Seems like there should be more I can do before it gets to that point. Anyone have experience with the type of data corruption explained here? And any possible tools I can use to recover? I just wish I understood better what Windows did to the drive, and understood more in general about different file system types.

  2. #2
    Linux Guru
    Join Date
    Oct 2007
    Tucson AZ
    Windows cannot read Linux filesystems and will usually just show any partition with a Linux filesystem as unallocated space. Obviously, microsoft could do this they choose not to. There is third party software which you can get to put on windows to read Linux filesystems. Unfortunately, that won't help now. I'm not sure what you did but you might try to recover the data by using TestDisk or PhotoRec software. You could google that to find the site or you could just search for SystemRescueCD which contains both, download it and burn it as an image so it is bootable.

  3. #3
    Linux Guru
    Join Date
    Dec 2013
    Victoria, B.C. Canada
    Not that it will help you with problem but for future reference - if you plan on sharing a drive with a windows machine you should format it with NTFS. OSX and Linux can deal with that format and it's native to MS.

  4. $spacer_open
  5. #4
    Thanks yanek. I tried TestDisk previously and unfortunately it was unable to repair the disk. I had not heard of PhotoRec before. This sounds really promising: "PhotoRec ignores the file system; this way it works even if the file system is severely damaged." I'll try this once I get my disk back from the pc guys. Thanks.

  6. #5
    Linux Guru
    Join Date
    Dec 2013
    Victoria, B.C. Canada
    Good luck. Let us know how it works out - it may help someone down the road.

  7. #6
    Linux Engineer docbop's Avatar
    Join Date
    Nov 2009
    Woodshed, CA
    You're probably going to have to use a forensics toolkit to try and recover data, it is not easy. I had done it in the past using The Corner's Toolkit, but it is no longer being developed. The replacement is a tool call Sleuth Kit: The Sleuth Kit (TSK) & Autopsy: Open Source Digital Forensics Tools

    Looking at Sleuthkit's wiki it will support ext4.

    With corners toolkit it would recover disk sectors and then sectors would have to be assembled to rebuild a file. Don't know if it's easier with Sleuthkit but gives you an idea of the work it is to recover data from a formated drive.

  8. #7
    So far PhotoRec is looking really positive. I finally got my drive back from the self-proclaiming 'geek' guys. I plugged in my hard drive, then started photorec with sudo testdisk-6.13/photorec_static. It saw the drive, I select the format that the drive used to be in before corruption, it asked me where it should place files that it can recover, and now it's chugging along. 32 minutes and it's already recovered this much:

    txt: 12919 recovered
    elf: 1925 recovered
    pyc: 1403 recovered
    tx?: 943 recovered
    a: 918 recovered
    mov: 488 recovered
    exe: 349 recovered
    gz: 315 recovered
    mp3: 150 recovered
    xz: 140 recovered
    others: 357 recovered

    I'll wait till the whole thing completed though before giving a final verdict, seems like currently the recovered files might be in a temporary state. There are all these folders that start with recup_dir.X where X is an incremental number. Inside each folder there are various file types and the names are all pretty nuts right now, stuff like f51481984. So hopefully it can recover some names too. Gosh this could end up being huge, now that I think about it. I was backing up a few PCs to this drive, and it might be trying to recover all that. Not sure if my hard drive has the space!

  9. #8
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
    A "good" learning experience. Linux handles Windows file systems (NTFS and FAT - other than encrypted ones) just fine. Windows does NOT handle Linux file systems at all, unless you install a Linux FS driver in Windows first (they are available).
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts