From owner-freebsd-questions@freebsd.org Wed Apr 11 09:37:49 2018 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1A353F83AFA for ; Wed, 11 Apr 2018 09:37:49 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "mout.kundenserver.de", Issuer "TeleSec ServerPass DE-2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7D6B4884DE for ; Wed, 11 Apr 2018 09:37:48 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from r56.edvax.de ([92.195.30.67]) by mrelayeu.kundenserver.de (mreue004 [212.227.15.167]) with ESMTPA (Nemesis) id 0LpAhs-1ea8hc2qJw-00euCi; Wed, 11 Apr 2018 11:37:40 +0200 Date: Wed, 11 Apr 2018 11:37:40 +0200 From: Polytropon To: Ernie Luzar Cc: "freebsd-questions@freebsd.org" Subject: Re: Recover directory tree with files from win10 HD Message-Id: <20180411113740.2b245110.freebsd@edvax.de> In-Reply-To: <5ACD536C.5010407@gmail.com> References: <5ACD536C.5010407@gmail.com> Reply-To: Polytropon Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K1:mPBCQ8HhizozbqcLUFv6jE6FEgRWr97wEZV3+lZHYyYWBfgaM6e ktlP1C3nq1kDlodr7nK3lo598BQ8pDIVh2DgP9KhvEf64DIzcI4KQP4TpzcH/x1rVZB2+tE brZ5N3+cIjqZDBQXl7seARXJsGqKFZwj0TdySAGyzIKcnYv+/JXc0tThUbexJpRTM4a1E50 ganSrRozyqrhswNW7Wy6g== X-UI-Out-Filterresults: notjunk:1;V01:K0:c4QkQAfqcSw=:R1rfUGVc4bZF/3bieROYDc ONpaE2wCISBfoBe7Rzq3i4C4D9onkSwYQuvaFjTinx3DOyKk8G35yekPn47Ih918S9VflZUj9 /UCWvpK1xnQG895MJw7ENQj2vuqNcLcDf2dhR4j7LMKH7XcEy9sB0emCOuYHYq2jbXuYf4sI8 fw7wbCscgvuFDAXXOGCLZSOOYPxoXoKMFejimnOGFX5NtMKHqMdvJJkHUY4pyps47b5AXt2U2 +AJH6+Jz01COq7yHE6zWTSQCpJjKQgC0n3Eb8YqWUU3lI8ib26bWl/Df9g25vv1vYRxrf+bh1 i+O4PdPu4i7aa5RN6D3LVErXmYWoD9LfsRsRHQqrWYm0Kwj5idPm7t1CLy986L6P7sahNXOdn yWJll2M0rXmP10qHy+4FKPsfeM3M7TR/ipR/ZWAQONXdWh0e7pPFfJkDaqi4bykk0KEUOLHeK 900EUXqsTSsC+EAgG8ICoyMC+NWrqED/4R4KYzKrUjZzrUWZn2wydtZpRb1ybsDKWU9ouC0md 1dw4h65f2Q/HHYt81diDFZYXGH4EyGnmGG938mRYwM+tN/1BkGDDIb413ORNY+qiauYYxMwNx tJ9WwOmHgcDxK2Krr5yu/aAKaBfmUsnPPymw+pL9zHYP6krKW7xSg9Sg3S1XcMFPUqsTtTVFZ vGYLMJxJp+/BB6v4l1Exas9QSQKfjbO4JNGYuYvjTrP1wSIdSJHvMfo5MDFReL+tT8nBVn8k4 Mjy9HA1eEFofNTOq0OSpw+7h9o4dorKoKV/puPnIRKQzF9QRCYAsNEOowpE= X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Apr 2018 09:37:49 -0000 On Tue, 10 Apr 2018 20:14:36 -0400, Ernie Luzar wrote: > My mothers win10 pc has external usb 3tb sata drive with 600gb of data > that has hardware data problems. It will not mount on win10 pc. Do not try any further with "Windows", it could do more damage. On "Windows 10", they use NTFS or FAT as file systems, and both are known to do the "funniest things" when getting into some inconsistent state ("silent" data corruption, data loss, no access due to damaged hiberfile, etc.). > My > mother has her whole digital life on the external drive. Just restore from backup! Sorry, couldn'r resist... ;-) > I can not find > any win10 software to recover the data from a drive that will not mount. First of all, use tools that work with a copy of the damaged disk (or partition). Create this 1:1 copy first in a read-only manner, then work with the image. Do not try to repair the data "on-disk", it will probably destroy more data and reduce the chances of getting the "whole digital life" back. Seriously. I'm not making this up - I learned from my own faults. Check the mailing list archives for the terrible truth. :-) Do not use "Windows" any further without knowing _exactly_ what the problem is. > I am thinking about using FreeBSD to recover the directory structure and > the files contained in them. Asking anyone if they know of a port that > will recover the data with their full file names in their directories? That depends on the actual damage. This is how you should proceed: 1. Make a 1:1 copy of the disk or partition. Use that copy in all further steps. (Two copies are handy, in case you mess up one.) 2. Examine the data. What has happened? Can you use FUSE's NTFS mount program to mount it read-only? Can you use tools from the ntfs-tools package to repair things like the MFT. Or is it a FAT drive? Try mount_msdos instead, maybe even fsck_msdosfs. It could be sufficient to copy all the data (cp -R). 3. No luck getting the partition to mount? Assume the data is still there. Make yourself familiar with professional forensic tools. Start with the easy ones. If they get back what you expect to recover, well done. If not, use the more complex ones. On this mailing list, I have published my "famous list of data recovery tools" from time to time. Note that in order to make use of that list, you'll have to learn (!) about lower-level file system design, because you _must_ understand what you're doing. Here is this list. Note that I've added a few comments that might help in your specific situation (damaged FAT or NTFS drive): System: dd <- for making 1:1 copy fsck_ffs clri fsdb fetch -rR recoverdisk Ports: ddrescue <- if 1:1 copy is hard dd_rescue <- same ffs2recov magicrescue <- get data back (no structure) testdisk The Sleuth Kit: fls dls ils autopsy scan_ffs recoverjpeg foremost photorec fatback <- FAT ntfs-tools <- NTFS (ntfsfix, ntfsinfo, ntfsmount) Keep in mind: It will take time. There is no "one size fits all" GUI solution where you just click and icon and then have all your files (and the directory structure) back. IN worst case, what you're searching for has already been overwritten by "Windows" attempting to "repair" it. Your alternative: Take $500-3000 and ship the disk to a recovery business. If a "whole digital life" is worth that much money, you can give them a change. Note that there is absolutely no guarantee that they will succeed. Good luck! -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...