Re: [gentoo-user] data recovery advice needed

[Mick]

On Tuesday, 18 December 2018 17:11:28 GMT Jack wrote:
> On 2018.12.18 04:43, Peter Humphrey wrote:
> > On Monday, 17 December 2018 23:19:39 GMT Jack wrote:
> >> At this point, I think I've forgotten the details, but using the
> >> example of a 300G drive with 100G empty and then a 200G partition,
> >> when I moved the partition to the beginning of the disk (using
> >> gparted, as I remember) once it moved more than the first 100G of
> >> the partition, it overwrote the beginning of the original partition,
> >> and once it overwrote any of the directory structure it still needed
> >> to know where stuff was, game over.
> >
> > Gparted can handle that without difficulty - I do it often - so I
> > think you must be mistaken in the tool you used.
>
> No, not mistaken in which tool, but likely mistaken in my memory of the
> exact course of events.  It's possible the gparted move operation was
> interrupted.  Could have been an accidental Ctl-C or a power failure.
> However, at this point, I'd need a better crystal ball looking
> backwards to know for sure.
>
> > Sorry not to be more helpful...
>
> I have more responses for elsewhere in the thread, but I think any
> further serious attempts at recovery are going to have to wait until I
> buy a new disk or two, so I can do everything internal on the desktop,
> and not on the laptop with USB.
>
> > --
> > Regards,
> > Peter.
>
> Jack

I know others have commented on the reliability of recovering data from drives 
connected via USB caddy, but I have had satisfactory results on a number of 
cases.

The last time I tried to recover data from a failing disk, which had SMART 
End-to-End errors increasing continuously and read errors with ddrescue going 
up each time I ran it.

I cloned the whole drive having run ddrescue backwards and forwards a couple 
of times.  c/f/gdisk would see all partitions, but when I tried to mount the 
cloned /dev/sdb4 (NTFS) with ntfs-3g it complained there was no device found 
(/dev/sdb4).  I got the same error with the failing drive.

So, I used losetup with --offset on the failing drive itself over USB 2.0 and 
was able to mount and recover all the NTFS files.

Over the years I've used clonezilla, ddrescue, testdisk, photorec and losetup 
to recover files.  On a couple of times where data on the disk had been 
overwritten by subsequent operations, I was not able to recover the affected 
files.  So, if when moving the partition data was overwritten I suspect it 
will be very difficult to recover this with conventional software tools.  
However, it doesn't hurt to try.  :-)

-- 
Regards,
Mick