2

I have a USB HDD that had been repartitioned (two times), but no data was written to it and only quick format was used to initialize the file system (from Windows 7).

It's a LACIE 500GB,with SAMSUNG HM500JI in it. Assumed partition type was HSF+ (it had been used on a Mac).

I have tried to search for partition information with testdisk, but with no results. I have managed to use foremost and scalpel to extract some files from the HDD.

The question is if I can rebuild filenames and directory structure if partition information was lost or can I only use carving tools?

Unreason
  • 473
  • what OS are you running? linux i'm assuming since you're talking about foremost and scalpel? – RobotHumans Sep 21 '11 at 09:49
  • well, I am doing recovery on a USB drive, running Ubuntu 11.04 in Virtualbox on Windows 7 host, controlling the Ubuntu remotely with teamviewer. :) – Unreason Sep 21 '11 at 09:52
  • 5
    First thing to do is image the drive (with dd), don't attempt recovery on the actual device that has the target data on it. – James Yale Sep 21 '11 at 09:55
  • @James Yale, that is generally good advice; but that is necessary if one is dealing with failing HDD or if one needs to write to it (also note ddrescue will do a better job compared to dd). – Unreason Sep 21 '11 at 09:58
  • 2
    @James is right for this case taking an image before trying recovery is sound advise regardless of if the disk is failing or not. – squareborg Sep 21 '11 at 10:17
  • if you're trying to get HFS with full file/directory structure...most of the consumer grade tools will need to be running on MacOS – RobotHumans Sep 21 '11 at 10:46
  • @aking1012, ok, but which tools and in which order... – Unreason Sep 21 '11 at 12:19

0 Answers0