Sonic Youth Gossip - View Single Post - computer nerd question

verme (prevaricator) · 11.01.2009, 09:57 AM

that wasn't very helpful was it?
i'm a lazy twat and always in a hurry.

i'll spare some time and attention to this place for a change and hopefully help you or some google tourist.

there really is no need to plug the hdd to other machine, in fact it doesn't make much sense, and by mounting the drive you'll potentially overwrite your precious mistakenly erased data.
live cd's, live usb's or whatever load into ram, allowing you to access your hdd without compromising data.

you can get clonezilla here:
http://clonezilla.org/download/sourc...-zip-files.php

i'm guessing you know how to burn an iso file and boot a cd, if you don't, just ask it here.
once you're booting up that cd what you want to do is to load the kernel to ram and enter a shell.
clonezilla has a graphical interface so you just have to pick those options using the arrow keys.
once you're looking at a flashing bar you can start interacting with the shell.

ntfsundelete is a program that can scan your ntfs partition for deleted files and recover them.
you can read about it by typing in the shell:

Code:

man ntfsundelete

use the arrow keys to skim through it, press q to close the manual.

you need to tell ntfsundelete where and what to look for. to find the path for your ntfs partition type in the shell:

Code:

sudo fdisk -l

this prints out the hdd partition table, the path to your partition should be something like /dev/sda2

type in:

Code:

sudo ntfsundelete fullpathtoyourpartition -m 'filename' -p 100 > filesfound.lst

this scans for fully recoverable files that match the filename and outputs the results to a file.

you can have a look at the results by typing in:

Code:

cat filesfound.lst

with luck, ntfsundelete found something.
plug a usb drive and take a look at the partition to get it's path.

Code:

sudo fdisk -l

it should be something like /dev/sda3

create a directory for it and mount the drive.

Code:

sudo mkdir /media/phoenixpendrive && sudo mount fullpathtoyourdrive /media/phoenixdrive && sudo mkdir /media/phoenixdrive/restoredfiles

recover the files and send them to your usbdrive:

Code:

sudo ntfsundelete fullpathtoyourpartition -u -m 'filename' -p 100 -d /media/phoenixdrive/restoredfiles

unmount the usb drive

Code:

sudo umount /media/phoenixdrive

and that's it.

Code:

echo goodbye phoenix && sudo shutdown -r now

p.s. if you dont recall the filelame use '*.mdb', '*.ldb' or whatever your file extension was.

11.01.2009, 09:57 AM	#8
verme (prevaricator) 100% Join Date: May 2009 Posts: 788	that wasn't very helpful was it? i'm a lazy twat and always in a hurry. i'll spare some time and attention to this place for a change and hopefully help you or some google tourist. there really is no need to plug the hdd to other machine, in fact it doesn't make much sense, and by mounting the drive you'll potentially overwrite your precious mistakenly erased data. live cd's, live usb's or whatever load into ram, allowing you to access your hdd without compromising data. you can get clonezilla here: http://clonezilla.org/download/sourc...-zip-files.php i'm guessing you know how to burn an iso file and boot a cd, if you don't, just ask it here. once you're booting up that cd what you want to do is to load the kernel to ram and enter a shell. clonezilla has a graphical interface so you just have to pick those options using the arrow keys. once you're looking at a flashing bar you can start interacting with the shell. ntfsundelete is a program that can scan your ntfs partition for deleted files and recover them. you can read about it by typing in the shell: Code: man ntfsundelete use the arrow keys to skim through it, press q to close the manual. you need to tell ntfsundelete where and what to look for. to find the path for your ntfs partition type in the shell: Code: sudo fdisk -l this prints out the hdd partition table, the path to your partition should be something like /dev/sda2 type in: Code: sudo ntfsundelete fullpathtoyourpartition -m 'filename' -p 100 > filesfound.lst this scans for fully recoverable files that match the filename and outputs the results to a file. you can have a look at the results by typing in: Code: cat filesfound.lst with luck, ntfsundelete found something. plug a usb drive and take a look at the partition to get it's path. Code: sudo fdisk -l it should be something like /dev/sda3 create a directory for it and mount the drive. Code: sudo mkdir /media/phoenixpendrive && sudo mount fullpathtoyourdrive /media/phoenixdrive && sudo mkdir /media/phoenixdrive/restoredfiles recover the files and send them to your usbdrive: Code: sudo ntfsundelete fullpathtoyourpartition -u -m 'filename' -p 100 -d /media/phoenixdrive/restoredfiles unmount the usb drive Code: sudo umount /media/phoenixdrive and that's it. Code: echo goodbye phoenix && sudo shutdown -r now p.s. if you dont recall the filelame use '.mdb', '.ldb' or whatever your file extension was.
	\|QUOTE AND REPLY\|