So, an NTFS-formatted hdd that had some files that I'd rather not lose started having some issues. Basically, the BIOS had a hard time detecting it (it slowed the boot process down a lot), and windows wouldn't boot, failing at various stages. As well, it was unmountable in ubuntu.

First, I put it in my computer, and set up a partition of the same size to copy to. Using ddrescue http://www.gnu.org/software/ddrescue/ddrescue.html (in package gddrescue in ubuntu), I copied the good data off it (slowly - this took about a week). Then, for a while, I let it have a go at recovering some of the data it had missed. Still, I was unable to mount the drive, getting errors about $MFT and $MFTMirr. So, looks like the master file table is damaged.

I had a look with testdisk http://www.cgsecurity.org/wiki/TestDisk, but this didn't help any. I eventually settled on using fls (in sleuthkit) to extract a list of viable filenames, and inodes.

#fls -r -u -p /dev/sda9 > /tmp/filenames

grep was used to cut the file to just the filenames I was interested in, and I disregarded those lines with *s in them, as they seemed to mean some corruption. I used a script from http://forums.gentoo.org/viewtopic-t-365703.html to do the rest, though as there were spaces in some of the directories, I was forced to modify the script so that it took all of the filename as one of the matches (I used sed, though cut would work better). Also, the indices in this were wrong for my input file, but that was easy enough to fix.

This recovered essentially all of the files; I'm sure there were a few it was unable to get, but I was still quite pleased.

Comments on this page are closed.