1
The first 7GB of a 500GB NTFS partiton was accidentally overwritten with another file. Is it possible to recover some of the data in the remaining 493 GB of the NTFS volume? The partition table is intact. The executed command was:
dd if=file of=/dev/sdc1
Thanks
Edit: My question is different. I overwrite first 7GB of NTFS partition. Other question mostly deals with hardware failures or bad sectors.
coolman
Posted 2016-11-16T20:56:13.730
Reputation: 41
3
SOLUTION: None of suggested solutions worked for my case. I partly solved my problem with RecuperaBit. RecuperaBit could recover a lot of small files, including important ones. But it failed to recover big (bigger than 1 GB) files.
In my opinion, only RecuperaBit solution should be advised such (beginning of NTFS volume overwritten) cases.
Thanks to everyone answered and tried to find a solution for me.
coolman
Posted 2016-11-16T20:56:13.730
Reputation: 41
There is no hardcoded limit on file size. Most likely your file had NTFS compression enabled. – Andrea Lazzarotto – 2016-11-25T17:10:50.863
1
On linux you can recover all the files in the not overwritten part with https://help.ubuntu.com/community/DataRecovery/NtfsUndelete
There are also similar tools for windows.
Very important is, that you do not write anymore to the disk, also restore the files to another disk. Otherwise you limit your chances of success.
edlerd
Posted 2016-11-16T20:56:13.730
Reputation: 156
ntfsundelete gave me this error:
NTFS signature is missing. Failed to mount '/dev/sdc1': Invalid argument The device '/dev/sdc1' doesn't have a valid NTFS. Maybe you selected the wrong device? Or the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around? – coolman – 2016-11-16T21:53:49.700
This tool cannot work if the file system is damaged. You can e.g. use RecuperaBit which I developed for that purpose. – Andrea Lazzarotto – 2016-11-18T01:06:11.440
@AndreaLazzarotto thank you for developing RecuperaBit. I can recovered a lot of valuable data with it. On the other hand it cannot recover big files. It shows big files name but file size as 0. Is there any way to recover big files? Thanks – coolman – 2016-11-25T16:42:30.327
@coolman There is no limitation on the file size you can recover. It doesn't work if NTFS compression is enabled, but that's clearly written in the warnings when running the program. Also, NTFS compression is disabled by default on every version of Windows. – Andrea Lazzarotto – 2016-11-25T17:09:00.860
For large files the possibility, that one of the sectors in which the file was stored is overwritten is much higher. Thats why you are able to recover many small files, but less likely to succeed with big ones. – edlerd – 2016-11-26T09:31:59.543
0
You would have to use a program like TestDisk to undelete files from your NTFS partition. EDIT: Although if you have a native program installed, as mentioned by edlerd, you may want to go with that instead
It's hard to say what data will or won't be available to you, but as long as you didn't overwrite all of it, I think you should be able to find some stuff.
Disclaimer: I haven't used TestDisk myself. It was the first result when I Googled "linux tool recover deleted partition". I have used similar tools in the past, however - you may want to shop around and see which you trust the most/find the most comfortable to use.
thegrapesoda
Posted 2016-11-16T20:56:13.730
Reputation: 91
This won't work if parts of the MFT are damaged. – Andrea Lazzarotto – 2016-11-18T01:03:59.113
1
Possible duplicate of How do I recover lost/inaccessible data from my storage device?
– DavidPostill – 2016-11-16T21:49:56.053This is different. I overwrite first 7GB of NTFS partition. Other question mostly deals with hardware failure or bad sectors. – coolman – 2016-11-16T22:08:45.887
See Recovering broken or deleted NTFS partitions.
– Andrea Lazzarotto – 2016-11-18T01:05:21.277