The day before yesterday, I was about helping a friend transfer a set of files to a mini-SD memory card. To achieve the task I had to tweak the files into an image and then write the image to the card. In the end the attempt failed, but because of a reason that I found out later.

The computer I used for this was my “server”, which holds my archives “Hyllan” (the Shelf) and “Valvet” (the Vault). The day after I found out that “Hyllan” wasn’t accessible, on inspection the contents of the tweaked image (above) appeared.

The reason: mistyping a device’s name at the command prompt. I had written the full 2GB – aimed for the card – onto the first sectors of my harddisk, effectively wiping the partition data and some unkown contents.

This is how it looked at this stage:

Note the missing “Hyllan” to the left of “temp-hyllan” – 576 GIGA bytes is a tremendous amount of data to lose. As I have been in similar situations before I had no reason to freak out. (Sidenote: Valvet is a RAID disk for higher safety on surface and disk failure)

The steps required to restore as much of the data as possible are these:

1. Make sure to NOT WRITE to the harddisk, the partition in particular.
2. Find temporary space to save the data – I believe I had at least 450 GB stored on that drive.
3. Run a choice of file recovery software; choose from at least “Runtime GetDataback”, “Active@ File recovery”, “MeetSoft Final recovery”
4. Hope that the software works; Save the data.
5. As you have either recovered the data – or give up – reformat the drive and copy back what you have.

Noteworthy here is that FAT filesystems are incredibly vulnerable to this kind of fault.
NTFS and other (e.g. Linux filesystems) are quite a bit easier in this regard (“Hyllan” was NTFS).
An md5sum-tool (or other similar) can be used to verify that the files are intact, given that you run a checksum creation on the disk contents BEFORE any mishap or failure. ZIP and RAR files have a built in checksum for all files – which can be used for the same purpose (“Test” the archive).

I got almost all files back (more than 99.9%), just a few were unrecoverable.

Advertisements