Re: [sleuthkit-users] Lost a folder on my hard drive somehow can I recover?

[Kaya S. <Sam...@ne...>]

Hi guys,

just wanted to bump my posting as no one responded!

I hope it's not because because the overall thought is that I failed to 
research or simply "ha ha ha ha ha get a life"....

I am merely asking for advice or knowledge from experienced members just 
to ensure that it's worth me spending the time and effort to go ahead 
with this; so that if it was a lost cause I could look at checking the 
integrity of the data already there or reformatting the drive and 
starting clean.

Many thanks,

Kaya



On 05/04/2010 05:12 PM, Kaya Saman wrote:
> Hi,
>
> I've got an external eSATA 200GB hard drive formatted to ext3 of which 
> I was using till now via USB2.0 connection.
>
> I recently hooked the drive up to my FreeBSD 8.0 32bit based server in 
> ReadOnly mode upon mount in order to stream the information across my 
> network so that I wouldn't have cables flying around the place.
>
> Anyhow, yesterday I attached the hard drive and started watching my 
> downloaded TV show. I noticed something went out of whack after I 
> clicked incremental files and the video shown was not linear. - What 
> I'm trying to say is that the file name didn't match the file played 
> back!!
>
> This originally was fine but somehow got messed up.
>
> Anyhow, I unmounted the drive and ran e2fsck -p on it which the check 
> claimed the disk was 'clean'.
>
> I mounted the drive again and the folder has totally disappeared now 
> and instead shows a file:
>
> -rw-r--r--  1 kaya kaya 2046682574 2009-09-13 07:06 
> Battlestar.Galactica.Season.1.720p.x264
>
> Using the df command it shows that the usage is back to normal as it 
> managed to drop down to 50% yesterday:
>
> /dev/sdb1             184G  137G   38G  79% /mnt/eSATAI
>
> I haven't written or deleted anything to the drive at all since the 
> error.....
>
>
> It could be that the FreeBSD ext2fs did something although I made sure 
> the drive was in ReadOnly mode or it could be the fact that I was 
> using the USB2.0 interface which I've always found to be dodgy when 
> used in conjunction with the ext3 file system.
>
> The files are all mkv format and the average size is roughly 4.8GB.
>
> I tried using GPart, Foremost, and MagicRescue but eventually fell 
> short each time although I think Foremost detects the files but in the 
> wrong format as WMV.
>
> Can anyone help me recover what ever has happened to this drive???
>
> The Sleuth Kit is install along with Autopsy, and I attempted to use 
> it but fell into a trap on the add disk image section. Do I need to 
> create an image or can I work from the raw drive?
>
> I am pretty sure the data is still there and rescueable as the drive 
> is pretty new, less then a year old I believe.
>
> Many thanks and best regards,
>
> Kaya
>
>
> ------------------------------------------------------------------------------
>    
>
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>