[sleuthkit-users] Lost a folder on my hard drive somehow can I recover?
Brought to you by:
carrier
From: Kaya S. <Sam...@ne...> - 2010-05-04 14:12:37
|
Hi, I've got an external eSATA 200GB hard drive formatted to ext3 of which I was using till now via USB2.0 connection. I recently hooked the drive up to my FreeBSD 8.0 32bit based server in ReadOnly mode upon mount in order to stream the information across my network so that I wouldn't have cables flying around the place. Anyhow, yesterday I attached the hard drive and started watching my downloaded TV show. I noticed something went out of whack after I clicked incremental files and the video shown was not linear. - What I'm trying to say is that the file name didn't match the file played back!! This originally was fine but somehow got messed up. Anyhow, I unmounted the drive and ran e2fsck -p on it which the check claimed the disk was 'clean'. I mounted the drive again and the folder has totally disappeared now and instead shows a file: -rw-r--r-- 1 kaya kaya 2046682574 2009-09-13 07:06 Battlestar.Galactica.Season.1.720p.x264 Using the df command it shows that the usage is back to normal as it managed to drop down to 50% yesterday: /dev/sdb1 184G 137G 38G 79% /mnt/eSATAI I haven't written or deleted anything to the drive at all since the error..... It could be that the FreeBSD ext2fs did something although I made sure the drive was in ReadOnly mode or it could be the fact that I was using the USB2.0 interface which I've always found to be dodgy when used in conjunction with the ext3 file system. The files are all mkv format and the average size is roughly 4.8GB. I tried using GPart, Foremost, and MagicRescue but eventually fell short each time although I think Foremost detects the files but in the wrong format as WMV. Can anyone help me recover what ever has happened to this drive??? The Sleuth Kit is install along with Autopsy, and I attempted to use it but fell into a trap on the add disk image section. Do I need to create an image or can I work from the raw drive? I am pretty sure the data is still there and rescueable as the drive is pretty new, less then a year old I believe. Many thanks and best regards, Kaya |