Attempting Recovery through Ubuntu...need help

[thewisecrab]

My friend's PC gave up on him a few days ago. I checked it and found that the boot loader has got corrupted, along with a few files going missing from the windows folder.
My opinion is that most of the data can be salvaged before a full format by transferring data to another partition.
I've currently got Ubuntu's Live CD with me. Anything I should know as to hope to go about?
Or is something else recommended?
PS. He was going to format his PC anyway , it's just that his PC refused to boot when he decided to back up

[thewisecrab]

Bump

[NucleusKore]

Yes you can recover the data.
Boot form the Ubuntu CD.
You will see all the windows partitions in the Places drop down menu as shown in the example below (10.7 GB). You can see only one partition in my example as there is, well, only one partition on that VM Click on each of them to open, and copy paste the data to a pendrive or usb hard disk.



If the above fails do a manual mount. If you do not know how to do that post back here.

[thewisecrab]

Originally Posted by NucleusKore

Yes you can recover the data.
Boot form the Ubuntu CD.
You will see all the windows partitions in the Places drop down menu as shown in the example below (10.7 GB). You can see only one partition in my example as there is, well, only one partition on that VM Click on each of them to open, and copy paste the data to a pendrive or usb hard disk.



If the above fails do a manual mount. If you do not know how to do that post back here.

Yes I'm aware of how to go about if the partitions are detected.
But what do I do if they are not detected? ie. How to do a manual mount?

[Rahim]

I am sure it will recognise the partitions.
Manual Mount Command

sudo mount /dev/sdax -t ntfs-3g /mnt/mountpoint

Dont forget to create a folder in /mnt folder.

[NucleusKore]

Manual mount
There's LOADS of documentation available on the usage of that command. I will try to give you ONLY what's required.

Open a shell (applications->GNOME terminal) or if you want to show your friend that you are geeky, press Ctrl+Alt+F1. You can press Ctrl+Alt+F7 to come back to GUI mode.

Type sudo fdisk -l and press ENTER
See the output. It will be something like this

Device Boot Start End Blocks Id System
/dev/sda1 * 1 1912 15358108+ 7 HPFS/NTFS
/dev/sda2 1913 19457 140930212+ f W95 Ext'd (LBA)
/dev/sda5 1913 4462 20482843+ 7 HPFS/NTFS
/dev/sda6 6708 11171 35857048+ 83 Linux
/dev/sda7 11172 19457 66557263+ 7 HPFS/NTFS
/dev/sda8 4463 4717 2048256 82 Linux swap / Solaris
/dev/sda9 4718 6707 15984643+ 83 Linux

As you can see, my first partition /dev/sda1 is an ntfs partition, and I have two other ntfs partitions /dev/sda5 and /dev/sda7

So if I want to mount these, I would first have to create a mount point - one mount point if I want to access them one at a time, or multiple mount points if I want to access them all together.

When you are recovering data I recommend that you access one partition at a time.

Creating a mount point:
Let us create a new mount point share in /mnt
Type sudo mkdir /mnt/share and press ENTER
Type ls /mnt to see your newly created mount point

Mounting:
When you mount using the mount command, you have to specify the filesystem type, the device you want to mount, and the mount point. Let us mount the first partition. In my case, my first partition has a filesystem type ntfs, device name is /dev/sda1 and I want to mount it to /mnt/share. So the command will be

sudo mount -t ntfs /dev/sda1 /mnt/share and press ENTER

Note that unlike what is suggested in the post above, I did not ask you to use the ntfs-3g filesystem type. This is because in data recovery we are happy with read only access, we do not really want to write to the partition. If you want to write to the partition, use ntfs-3g in the above command instead of ntfs. If your filesystem is FAT32 it will show up in the fdisk -l output as vfat. In that case use the parameter vfat instead of ntfs in the above command.

Recover data:
In the GUI mode, simply browse to /mnt/share and copy paste to wherever you want.

In text mode (geeky), first decide where you want to copy the data to. See the output of fdisk -l
Any pendrive usbdrive will show up as /dev/sdbx or /dev/sdcx where x is a number from 1 onwards.

Create a new mount point
Type sudo mkdir /mnt/usbshare and press ENTER
Type ls /mnt to see your newly created mount point

Mount the pendrive
sudo mount -t vfat /dev/sdb1 /mnt/usbshare and press ENTER

If you get an error message saying that the drive is already mounted then check for the same. Just type the command mount and press ENTER. Most likely the pendrive would have been automatically mounted to /media/disk

Also note that if you have a hard disk or pendrive with multiple partitions, then they will be automatically mounted as /media/disk /media/disk-1 /media/disk-2 etc.

Let us say I want to copy the data from /dev/sda1 which I have mounted on /mnt/share to my pendrive on /dev/sdb1 mounted on /mnt/usbshare
The command will be
sudo cp -rv /mnt/share/ /mnt/usbshare/
or
sudo cp -rv /mnt/share/ /media/disk/

After the files have been copied, type
sudo ls /mnt/usbshare
or
sudo ls /media/disk
to check the destination folder/drive.

Unmount your hard disk partition:
sudo umount /mnt/share

[thewisecrab]

Wow, you have really put a lot of effort into this post.
Thank you NucleusKore and a_rahim

[Rahim]

Nucleus bro pawns me

[NucleusKore]

No need to say that^
We're all learning here

[Rahim]

^Definitely! You are teaching me

[thewisecrab]

UPDATE:
I had to manual mount one of his partitions, using NucleusKore's help.
Other than that, other partitions were detected automatically
Thanks all, my friend is formatting his PC as we speak knowing well his data is safe

[NucleusKore]

Originally Posted by Kl@w-24

Now this is getting REALLY sh1tty. The posts are disappearing at random and then reappearing. If you admins don't care, just tell us. We'll bugger off to somewhere else rather than pin hopes on you lot taking some measures.

LOL... I really do not know how I got to this thread
I was here
Attempting Recovery through Ubuntu...need help

and I clicked "quote" to quote thewisecrab's message in the reply, and this thread opened with the above quote ??!! and the wisecrab's reply that start's with update has disappeared :-P

[NucleusKore]

Man this is INSANE, I was just shunted from another thread :-S

Anyway, what I wanted to say is that your experience as described above points to the possibility that the FS of the partition you had to manually mount might have had errors. In future if you encounter such a situation first check the partition for errors with chkdsk in Windows and then backup. If the Windows is not bootable use UBCD4WIN.

[thewisecrab]

Originally Posted by NucleusKore

Man this is INSANE, I was just shunted from another thread :-S

Anyway, what I wanted to say is that your experience as described above points to the possibility that the FS of the partition you had to manually mount might have had errors. In future if you encounter such a situation first check the partition for errors with chkdsk in Windows and then backup. If the Windows is not bootable use UBCD4WIN.

Man this forum is becoming less usable day by day..
I have UBCD's ISO without Windows Build (which suffices for me most of the time)
But anyway, data on that mounted partition was recovered successfully

[Rahim]

^Nice to hear that you were able to recover your data.