2

The program I'm looking for has to be for OS X, GNU/Linux (or maybe even Android), as Windows won't even recognize my drive.

I'm trying to recover data from a hard drive, but I'm only getting the files, not the folder hierarchy, file names, file metadata, etc. But I need to recover all that. What kind of tool can I use? I have already tried the app Disk Drill for OS X.

This is the situation:

  1. Friend 1 has a 600GB external HDD (FAT 32 formatted) that he has been using with Windows 7.

  2. With hundreds of GB of space already used, Friend 1 gave it to Friend 2 who then used it with OS X Snow Leopard. Friend 2 transferred many more gigabytes to the drive. He then ejected and unplugged it.

  3. Friend 2 now tells me that when he, a few hours later, again plugged the drive into his SL Mac, it appeared to be totally empty, with all the space in it available. He says that all he could see were some weird folders which he claims had Arabic names. The drive was in his physical possession the whole time, and we know that nobody else had physical access to it. Moreover, the SL Mac was never online. He then gave me the drive and asked me to help him recover the data. apparently the data of Friend 1 in there was important (Yeah, I know, that guy should have had a second backup.)

  4. So, since it was FAT32 formatted, I booted into Windows 8 to have a look at it. But Windows 8 wouldn’t even recognize the drive. The OS didn’t even mention the drive in any way.

  5. So I booted into OS X Yosemite. The drive came up, but, just like Friend 2, I found it to be totally empty. Except for the folders .fseventsd, .Spotlight-V100 and .Trashes. Also, OS X says only 371 MB is used, while the data is supposed to be hundreds of gigabytes. I could not see the folders spoken off by Friend 2 with supposed Arabic names.

  6. I ran an OS X app called Disk Drill on the drive. In a mode called "Quick Scan", it finds nothing, except for 33 KB in the Trashes folder. That folder contains a single, 33 KB file called journalAttr.3.

    In a mode called "Deep Scan", it found hundreds of gigabytes of files. But all the file names and folder hierarchy are missing.

File names and folder hierarchy, as well as file metadata, are important. They are a big part of the data. It would be a huge mess without that information.

Which tool can I use to recover filenames, folder hierarchy and file metadata in this situation?

Improve this question
2
  • "weird folders which he claims had Arabic names" sounded like a possible malware infection, but Windows not recognizing the drive at all sounds like a hardware failure - maybe the drive is just about broken
    – Xen2050
    May 6, 2016 at 12:05
  • @Xen2050 Yeah, who knows. I was never able to recover everything.
    – Fiksdal
    May 6, 2016 at 12:19

1 Answer 1

Reset to default
2

TestDisk is the tool you probably want to use. It is cross-platform (so you can use it on Linux as well as on Mac OS X). You will need to run it as root, and have it discovering the disk.

If possible, it does recover the folder hierarchy, file names, and/or file metadata. Whether it's possible depends on several things: what file system was used (e.g. with FAT based systems, structure is easier to find than with EXTFS), how much was destroyed, etc.

TestDisk will scan the partition table and show you available partitions, which it then can scan for data. It is able to check for deleted files as well as for existing ones, restore data one believed lost. Restored data should of course go to a different disk, so make sure you have enough space available at some place.

Additional details can be found in my answers to

Improve this answer
10
  • I appreciate that TestDisk is open source and free. I actually am using it to restore the whole disk right now. However, does it generally recover the folder hierarchy, file names, and/or file metadata? That is what I specifically asked for in OP. In my case, it doesn't seem to do it. But neither did Disk Drill. Does TestDisk generally recover the folder hierarchy, file names and file metadata?
    – Fiksdal
    Apr 8, 2016 at 15:13
  • 1
    If possible, it does. Whether it's possible depends on several things: what file system was used (e.g. with FAT based systems, structure is easier to find than with EXTFS), how much was destroyed, etc.
    – Izzy ♦
    Apr 8, 2016 at 17:00
  • Oh, actually, I had been using the program called photorec, sorry, my bad.
    – Fiksdal
    Apr 8, 2016 at 17:26
  • 1
    That's the companion program, yes – to recover accidentally deleted files. TestDisk goes a step deeper and lets you restore partitions. One usually restores an entire partition to an image file, and then can use PhotoRec on that to get hold of the files.
    – Izzy ♦
    Apr 8, 2016 at 19:54
  • 2
    OK.. Anyway, I went ahead and asked all this in Testdisks's official forum, as that's where it's the most on topic.
    – Fiksdal
    Apr 9, 2016 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.