Ubuntu – Recovering broken or deleted NTFS partitions

data-recoverydual-bootfilesystemmountntfs

About two weeks ago I had a problem with my PC that my brother wrote a question about at PC not booting after using Windows 7 auto-repair.

I still haven't solved the problem, so my PC is unusable now.

Now I think that it would be simpler to re-install both Win7 & Ubuntu than repair them, but there're some data on their partitions. I want to recover this data.

These partitions are not mountable for some reason. I don't know why.

sudo fdisk -l about the problematic partitions: 

Device    Boot      Start         End      Blocks   Id  System
/dev/sda1            2048     147912703    73955328   83 Linux
/dev/sdb2            206848   174079999    86936576    7  HPFS/NTFS/exFAT

And in GParted:

enter image description here

enter image description here

And the error of the mount command:

Failed to mount '/dev/sdb2': Invalid argument
The device '/dev/sdb2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

And the exact same message for /dev/sda1

How can I recover my data from those HDDs?

EDIT

I have tried to specify the type of the drive:

$ sudo mount -t ext4 /dev/sda1 /olddisk
mount: wrong fs type, bad option, bad superblock on /dev/sda1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
$ sudo mount -t ntfs /dev/sdb2 /olddisk
NTFS signature is missing.
Failed to mount '/dev/sdb2': Invalid argument
The device '/dev/sdb2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

EDIT

sudo ntfsfix /dev/sdb2 returns:

Mounting volume... NTFS signature is missing.
FAILED
Attempting to correct errors... NTFS signature is missing.
FAILED
Failed to startup volume: Invalid argument
NTFS signature is missing.
Trying the alternate boot sector
Unrecoverable error
Volume is corrupt. You should run chkdsk.

Best Answer

Disclaimer: I provided an answer to similar questions here and here. This is a summary of those two answers. Moreover, I am the developer of RecuperaBit.

Your NTFS partition is broken. In order to restore the data, you need to make a copy of it (ideally) and then use a NTFS reconstruction software to restore its contents.

Clone the drive

You really should clone the drive in a file on an external disk, unless it is so big you can't find another drive than can contain it.

If you are really sure the NTFS partition coincides with /dev/sdb2, then use ddrescue to copy only that one:

sudo ddrescue /dev/sdb2 /media/user/External/copy.img /media/user/External/status.log

If you are not sure, it is much better to clone the entire /dev/sdb drive. This will take more space, of course:

sudo ddrescue /dev/sdb /media/user/External/copy.img /media/user/External/status.log

The status.log file is not mandatory, but it is needed if you want to pause the process and resume later on.

Analyze and reconstruct the file system

If the file system is only slightly broken, you may have luck with testdisk:

testdisk /media/External/copy.img

Follow the step-by-step procedure in the CLI and you will be able to list the contents of the partition with the P key, assuming it is almost intact.

If the damage is more serious, you need something else. You can recover (possibly severely) damaged NTFS partitions using RecuperaBit. RecuperaBit attempts to reconstruct file system structures and recover files. RecuperaBit attempts reconstruction of the directory structure regardless of:

  • missing partition table
  • unknown partition boundaries
  • partially-overwritten metadata
  • quick format

Currently, it does not require installation, you need to download the archive from GitHub and extract it in a directory of your choice.

After that, create a directory for the output and start the program with:

mkdir /media/user/External/recovered_files
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save

You might also use python, however pypy is faster. The scanning process will take quite some time. When it's done, type recoverable and find the id of your partition. If it is e.g. 2, type:

restore 2 5
restore 2 -1

5 means the Root directory and -1 means the Lost Files directory.

For additional details, explanations and caveats, see the two links at the top of this post.

Related Question