I reallly need your input, so any information is helpful.
I wanted to convert my windows7 machine to ubuntu mate. It has 2 drives, one is the old win7 os hdd, the other one is my data hdd. Upon selecting the installation drive, there were /dev/sda and /dev/sdc. I didn't really pay attention to the drive size, and I just went ahead formatting the /dev/sda from NTFS to EXT4. while the formatting was in process. I realized that I actually formatted my data hdd instead of the hdd containing the original win7 os.
The formatting process had run for a good 15 seconds or so, and I immediately cancelled it and shut it down. I pulled the hdd and put it into external hdd caddy. Now it already shows up as wiped out disk. Can this be restored using data recovery software?
I know I once accidentally formatted a hdd, but it was NTFS to NTFS, so it was still the same filesystem. I was wondering if in this case, NTFS to EXT4 can still be recoverable...
Before doing any of these, do I need to clone the hdd first? I mean, is the option you told me will be destructive when the recovery process is running? I wanna be safe than sorry.
Also, mostly the file i will be recovering is CR3 and jpg files.
Backups are always a good thing, so it would be a good idea to clone.
testdisk begins as read-only, as there's a Write option to confirm the recovered partition layout. It does have another option to List files and copy them to another medium, which would be safer.
I admit I haven't ever had luck with GParted for recovery - even just testing it now, it can't find a partition I literally just deleted.
If both tools are unable to recover the NTFS partition, use sudo photorec to recover the files (rather then the partition layout) but this won't have any file names.
Both photorec and testdisk are well documented here:
I tried using my another 1 TB disk, turn out, it's not big enough to hold 1tb cloned. so I am currently making a space for the image clone, moving files from 1.5TB hdd.
Now I have another problem needing to address first before I can run testdisk on the image clone.. So while copying the file from 1.5tb disk to another disk. The ubuntu mate has been logging itself off. It keeps happening while the file transferring in progress. The third time has just happened.. How do I debug or find what causing ubuntu to logging off by itself?
Now copying 1.5TB worth of files take a long time. and I don't want to repeat from the start everytime.
Logging off by itself suggests to me the display server (Xorg) or mate-session is fatally crashing. Anything that kills off the X server will kill any processes in that session and return to the login screen.
Check the output of dmesg and the logs in /var/log/ for any clues. There is a MATE log viewer in the System Tools.
Instead, perhaps just use the console with CTRL + ALT + F1 and create the clone using the command line:
To list your drives:
sudo fdisk -l
Let's suppose the external one is /dev/sdb1, then make sure it's mounted as follows:
sudo mount /dev/sdb1 /mnt
Then if the drive we want to backup is /dev/sda, clone like so:
My mate session has just logged off itself again just now. what log do you need to see? I will paste it here. FYI, I don't know if it helps, but i think this abrupt logging off problem only happens when there's a file transfer in progress, and I'm doing something else, like browse the web, etc.
I pressed that key combination while I was transferring files and it brought me to fullscreen console session. How do I get out and back to mate session?
The session logged itself off again in the middle of sudo dd command. Around 5 hours into the process..I attached the log output you need. Hopefully it helps you investigating the source of the problem.
I'm not actually a kernel developer, in this case I don't know why it's crashing - but the system restarting on its own isn't normal, especially on a console session. It's probably not Xorg.
The logs suggest the crash happened 2 hours after the USB 3 device was plugged in? Could it be the system overheating?
Perhaps try running the clone from a live session?
Or... go ahead and try testdisk without cloning - but don't click Write on anything. There is the possibility the tool can't recover the NTFS partition as-is, in which cloning would be a waste of time. In that scenario, you'd have to use photorec to recover the files (without names) onto a different drive.
Just wanna report back, so I followed your @lah7 suggestion, I clone the hdd image using the ubuntu live session. It successfully finish the job without problem. Thanks for that..
I first tried the testdisk, analyzed it and I simply changed the filesystem type to ntfs, the image became unreadable. So I google again and I stumbled upon this article and his article. There's thing forensic filesystem reconstruction software called RecuperaBit. I decided to give it a try, and It's working, it can read the full directory structures before I accidentally reformatted it to other ext4. Now it's still in the process of recovering those files. Hopefully everything is recoverable..
Btw, I tried the photorec before that, it found the lost files but it doesn't seem to be able to recover the original file name.
live session?