Data Recovery with TestDisk

some rights reserved by epSos .de

 You buy a portable hard disk drive to keep a back up of all your important data, Or you are carrying an extremely important doc in a USB drive, or you have some data on your internal hard disk drive. You try to get the data and ... boom!!! No Data!!! You have absolutely no clue how to get back the important data you had in the drives. Finally you just consider it lost and curse your fate and carry on.

This happened to me too. 1 TeraBytes of important data in my external Hard disk drive got corrupt in a second and was lost. I tried all OS's i could right from MAC to Windows to Linux but no luck. I was about to give up when i came across Data Recovery softwares on Internet.

Data Recovery softwares are those softwares that help you read corrupt/lost/deleted data from your drives. There were so many softwares out there. I started trying out my luck on all the softwares i could with a windows machine(i should not have done that, but i have no option!!). Unfortunately most of them just gives a list of deleted items on the disk that i never needed. One or two of them did get me the data however since they were trial versions, i could only view the data and not copy them. Anyways it just gave me the hope that the data was still there in the disk.

Finally i searched for Open Source alternatives and there i got my answer. TestDisk!!!

What is TestDisk?
As per their website wiki: TestDisk is a free data recovery software designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses, or human error. It can also be used to repair some filesystem errors.

Installation:
You don't need to install it. Its a very small 1.5 MB software, where you just need to run the executable, it was really easy to use command line based software with most of the information self explanatory.

Steps to Use:

1. Logs Creation : Like every other Linux based software, this one as well makes a log of every session carried out. when you execute the TestDisk.exe You are 1st asked for if, you would like to CREATE a new log, APPEND  the existing log, or want NO LOG.
2. Media/Disk Detection :Next you need to select the disk you want to recover the lost data from. It shows a list of all volumes connected to you computer and you can select using keyboard arrow keys.
3. Disk/Partition Table Type Selection : The next screen prompts you to select the partition table type. In most of the cases it detects all by itself the type. Otherwise it keeps it to none for you to select. Mine was a windows machine that i was running this program on and i used this with quiet a many volumes and every time it detected Intel. I am assuming windows users could probably select Intel in case they are unsure of this option. But selection "None"is not recommended as its very rare that a drive is non partitioned.
4. Next Screen Gives the following Options :

Analyse Analyse current partition structure and search for lost partitions to restore them
Advanced Filesystem Utils

FAT: Boot and FAT repair

NTFS: Boot and MFT repair

ext2/ext3: Find Backup SuperBlock
FAT file undelete
NTFS file undelete
ext2 file undelete
Image Creation

Geometry Change disk geometry

Options Modify options

MBR Code Write TestDisk MBR code to first sector

Delete Delete all data in the partition table

Analyzing of disk is done to look for lost partitions. This takes long time based on the size of the disk. Most of the times for windows if you get an error "The type of the file system is RAW." or "The disk in drive D is not formatted. Do you want to format it now?" then that means the Boot sector is damaged. You can click on Advanced file system Utils and and use the FAT: Boot and FAT repair/NTFS: Boot and MFT repair based on the type of partitioin you have. This was the problem with my disk too and got corrected in no time.



To be contd ...

Second Place Story : Server ghouls haunt bulk ingestion

Some rights reserved by Julie Rybarczyk

I recently shared one of my stories while monitoring an Ingestion Server with AppFirst for one of the Halloween contest they conducted. Thankfully, won 2nd prize in the same. Sharing the same story here along with the link to visit.

Second Place Story

Server ghouls haunt bulk ingestion
Company: Roshvert
I was suppose to monitor an Ingestion Server that was performing a bulk ingestion through an EC2 instance with around 200 GB of data to be ingested to another server.
Since it was a huge amount of data and the ingestion would take another day to complete, I kept the ingestion going and the logs were performing well. I decided then that I’d log in early tomorrow morning to check the ingestion status. During this time, the log files were supposed to be created automatically through the ingestion and the name of the log file for any particular day should be log_dd-mm-yyyy.txt with date of that day mentioned. It was a staging server and the code was supposed to be supplied for UAT in a day or two.
I logged in early the next morning to check the ingestion status. I was totally puzzled as I couldn’t make out what was happening:

• The log file for the previous day log_27-08-2013.txt was showing everything went well until 11pm midnight and no logs thereafter.
• The log file for today log_28-08-2013.txt got created with no data in it.
• The ingestion process was running with no errors.
• The server logs showed no errors.
• The system never went down.
• Nearly 150 GB of data was still to be ingested and was not progressing at all.
• None of the logs showed any updates as to why the ingestion was not progressing.

Since the delivery was urgent, I stopped the ingestion on the instance and restarted it. To my horror, the ingestion was not progressing at all. I tried running ingestion on other instances, and it worked fine.
Then something hit me, and I went back to check the logs of ingestion. The ingestion logs still showed nothing with 0 kb space used by the logs. Wait!!! Space? 0kb? 150 GB data still remaining?
I immediately checked the disk space and found zero space available. Whoaa!!!
What actually happened is while performing the ingestion, the server created a duplicate copy of the data on the same instance, and until the entire ingestion completes, this data used to remain there. Around 250 GB of disk space was used by ingestion by midnight and the disk was full. I immediately attached a bigger volume to the instance and restarted the ingestion. Thankfully it was complete in a few hours and that saved me from a big trouble!!!