[sleuthkit-users] Lost a folder on my hard drive somehow can I recover?

[Kaya S. <Sam...@ne...>]

Hi,

I've got an external eSATA 200GB hard drive formatted to ext3 of which I 
was using till now via USB2.0 connection.

I recently hooked the drive up to my FreeBSD 8.0 32bit based server in 
ReadOnly mode upon mount in order to stream the information across my 
network so that I wouldn't have cables flying around the place.

Anyhow, yesterday I attached the hard drive and started watching my 
downloaded TV show. I noticed something went out of whack after I 
clicked incremental files and the video shown was not linear. - What I'm 
trying to say is that the file name didn't match the file played back!!

This originally was fine but somehow got messed up.

Anyhow, I unmounted the drive and ran e2fsck -p on it which the check 
claimed the disk was 'clean'.

I mounted the drive again and the folder has totally disappeared now and 
instead shows a file:

-rw-r--r--  1 kaya kaya 2046682574 2009-09-13 07:06 
Battlestar.Galactica.Season.1.720p.x264

Using the df command it shows that the usage is back to normal as it 
managed to drop down to 50% yesterday:

/dev/sdb1             184G  137G   38G  79% /mnt/eSATAI

I haven't written or deleted anything to the drive at all since the 
error.....


It could be that the FreeBSD ext2fs did something although I made sure 
the drive was in ReadOnly mode or it could be the fact that I was using 
the USB2.0 interface which I've always found to be dodgy when used in 
conjunction with the ext3 file system.

The files are all mkv format and the average size is roughly 4.8GB.

I tried using GPart, Foremost, and MagicRescue but eventually fell short 
each time although I think Foremost detects the files but in the wrong 
format as WMV.

Can anyone help me recover what ever has happened to this drive???

The Sleuth Kit is install along with Autopsy, and I attempted to use it 
but fell into a trap on the add disk image section. Do I need to create 
an image or can I work from the raw drive?

I am pretty sure the data is still there and rescueable as the drive is 
pretty new, less then a year old I believe.

Many thanks and best regards,

Kaya