Re: [sleuthkit-users] Lost a folder on my hard drive somehow can I recover?

[Joseph R. M. <jr....@gm...>]

You can try using testdisk, but you might want to grab a full disk image
backup before trying it.  It helped me out in a similar situation.

http://www.cgsecurity.org/wiki/TestDisk

On a separate note, don't be surprised if a mailing list doesn't help you
retrieve your pirated media collection.  Just saying.

On Fri, May 7, 2010 at 6:04 AM, Kaya Saman <Sam...@ne...> wrote:

>  Hi guys,
>
> just wanted to bump my posting as no one responded!
>
> I hope it's not because because the overall thought is that I failed to
> research or simply "ha ha ha ha ha get a life"....
>
> I am merely asking for advice or knowledge from experienced members just to
> ensure that it's worth me spending the time and effort to go ahead with
> this; so that if it was a lost cause I could look at checking the integrity
> of the data already there or reformatting the drive and starting clean.
>
> Many thanks,
>
> Kaya
>
>
>
>
> On 05/04/2010 05:12 PM, Kaya Saman wrote:
>
> Hi,
>
> I've got an external eSATA 200GB hard drive formatted to ext3 of which I
> was using till now via USB2.0 connection.
>
> I recently hooked the drive up to my FreeBSD 8.0 32bit based server in
> ReadOnly mode upon mount in order to stream the information across my
> network so that I wouldn't have cables flying around the place.
>
> Anyhow, yesterday I attached the hard drive and started watching my
> downloaded TV show. I noticed something went out of whack after I clicked
> incremental files and the video shown was not linear. - What I'm trying to
> say is that the file name didn't match the file played back!!
>
> This originally was fine but somehow got messed up.
>
> Anyhow, I unmounted the drive and ran e2fsck -p on it which the check
> claimed the disk was 'clean'.
>
> I mounted the drive again and the folder has totally disappeared now and
> instead shows a file:
>
> -rw-r--r--  1 kaya kaya 2046682574 2009-09-13 07:06
> Battlestar.Galactica.Season.1.720p.x264
>
> Using the df command it shows that the usage is back to normal as it
> managed to drop down to 50% yesterday:
>
> /dev/sdb1             184G  137G   38G  79% /mnt/eSATAI
>
> I haven't written or deleted anything to the drive at all since the
> error.....
>
>
> It could be that the FreeBSD ext2fs did something although I made sure the
> drive was in ReadOnly mode or it could be the fact that I was using the
> USB2.0 interface which I've always found to be dodgy when used in
> conjunction with the ext3 file system.
>
> The files are all mkv format and the average size is roughly 4.8GB.
>
> I tried using GPart, Foremost, and MagicRescue but eventually fell short
> each time although I think Foremost detects the files but in the wrong
> format as WMV.
>
> Can anyone help me recover what ever has happened to this drive???
>
> The Sleuth Kit is install along with Autopsy, and I attempted to use it but
> fell into a trap on the add disk image section. Do I need to create an image
> or can I work from the raw drive?
>
> I am pretty sure the data is still there and rescueable as the drive is
> pretty new, less then a year old I believe.
>
> Many thanks and best regards,
>
> Kaya
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> sleuthkit-users mailing listhttps://lists.sourceforge.net/lists/listinfo/sleuthkit-usershttp://www.sleuthkit.org
>
>
>
>
> ------------------------------------------------------------------------------
>
>
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>