Two weeks ago, I started an upgrade on my main PC, totally redoing the operating system, and starting with a fresh machine. I wiped the hard-drive, and installed the latest version of Linux Mint. Like a good user, I backed up my data, including my web browser’s data, email and four other programs I use often. Everything was going tick-it-eey-boo, until it came time to add the data files back to my PC. I posted on this before last week about my broken four terabyte external hard-drive.
Today, my brand new six terabyte internal hard-drive arrived! So the work began. I knew my data was on the four terabyte expansion drive, but it had dead sectors on it, preventing it from mounting. The only way was to either fix it, or try and crudely recover what data I could get from it. I could not fix the bad sectors. Also it was not enough to extract the files; my files I wanted were to big for Testdisk/Photorec to work. On my PC, I had a one terabyte drive, so not enough to image the expansion drive. Now with the six terabyte drive, I can image four terabytes with no troubles.
Let use pause for a moment. I have tried several forensic software programs in the past. When I was in university, I had access to the same programs as the Government had, sometimes even better. I concluded that the Linux forensic programs worked just as good as what the university had as far as data extraction goes. Instead of a nice fancy GUI, in Linux you use command-line software. In the end, I found that running this sort recovery software through a terminal is way better, and being “free” does not hurt either.
So let me introduce you to Testdisk. I will not go into how the program works here, but it is good and powerful. I think it is very straight foreword, but it will be very intimidating to the first tine user–but fear not!
Recovering four terabytes is a long…, (make that a) “very long” process. The analysis of the drive took nearly one hundred and twenty hours. So far, imaging the drive, at twenty-five percent, has taken ten hours. So this is something you let run in the background, and make sure you turn off all power saving settings on your PC when you go to bed.
So hopefully, by Thursday, I will have my data. I will write a post after I have completed this process. I think there are not enough help files to guide people through this. So stay tuned.