Thread: HELP Please - Recovery of my DJ

I deleted (shift+del) my DV folder (My dream journal in it) accidentally yesterday. I used Recover My Files. I couldn't find the folder. But I found the word file. I recovered it. But I couldn't open it. And its name was changed. Please help, I've got around 70 dreams recorded in that file.

Probably a bit late
(the more you use your machine, the more and more unlikely it is that you'll recover anything useful)

but, you could try the Trinity Rescue Kit
http://trinityhome.org/Home/index.ph...=5&front_id=12

See manual sections 2.8 & 3.2

Section 2.8
http://trinityhome.org/Home/index.ph...53&front_id=12

2.8 Ntfsundeleteall
This script is a simple wrapper for the utility 'ntfsundelete'

What it does is find all deleted files on an ntfs volume and tries to recover them. It does this by looking for traces in the ntfs Master File Table and sees whether the file is still available on the disk (or partially overwritten). It 's a good utility that recovers your files with the original filename but without the relevant path in front. So to avoid double recovered filenames, I 've written the script so that it prepends the original inode (=internal number for the file on the filesystem) before the filename, so you always have a unique filename. It 's up to you to rename the files afterwards, but at least you have the original name in the recovered filename.

Here 's how the script works

Suppose you have the volume /dev/hda1 in ntfs from which you wish to recover files.
Make sure this volume is NOT mounted
Prepare a place to which you can store your recovered files. Recovered files will never be written to the original partition from which you recover them because the risk exists you will overwrite other files that still need recovery. Let 's say you have space on a network volume that you 've mounted on /mnt0 (for this procedure, see the section "Getting around with commands"), with a subdir called "recovered"
Here 's the syntax of ntfsundeleteall:
ntfsundeleteall Device Savedir [minimum percentage] --force

Now here 's how we do it in our example:
'ntfsundeleteall /dev/hda1 /mnt0/recovered'

This is very simple, this will recover any file it finds, even if only 1% of the file is recoverable. You 're probably not interested in that, because these files are most likely to be corrupt and unusable, so you add a parameter on the percentage you wish the file is recoverable. If we only want 100% recoverability, make the command like this:

'ntfsundeleteall /dev/hda1 /mnt0/recovered 100'

You will see the directory /mnt0/recovered filling up with recovered files, hopefully your file is in there.

You might have noticed the parameter "--force". This will only skip the check that your filesystem is ntfs, you can use this if you think your filesystem is so badly damaged that it won 't even be recognized anymore, but I doubt you will be even capable of recovering any files then.

Another recommendation I can give you is Photorec. Photorec is a third party utility that is able to recover files in a unique way: it is independent of the filesystem, it just does raw read of the disk (tries to use as much info as it can from whatever filesystem there was on it) and tries to recognize known document formats to recover whatever it can find. Although the name implies it might only serve to recover pictures, it can in fact recover any kind of important document, including word and excel, but also file archives such as zip and tar.gz.

The only thing you won 't get from this utility is the original filename, so you 'll have to sort out your recovered documents one by one.

Section 3.2
http://trinityhome.org/Home/index.ph...60&front_id=12

3.2 Recovering deleted files or files from formatted drives (ntfsundeleteall, photorec)
In TRK, there are several ways you could go and undelete files. What you should use depends on the state of your harddisk/filesystem and recoverability can vary between various methods.

Ntfsundeletall

First method already explained earlier is ntfsundeleteall (section 2.8), so I 'm not going to re-explain this. What I should mention about this method is that it has a high recoverability ratio on recently deleted files (deleted in a normal way, not because of a crash or filesystem corruption). It does however a poor job on drives that have already had more write I/O over them. It 's completely unuasable on formatted drives.

Photorec

In all other cases, you can try the photorec utility, which tries to recover any important kind of document from any filesystem. Be sure to run it by first changing to a place where you can write your stuff, because it saves its recovered output to a subfolder relative from where it was launched. Example:
'mount //10.0.0.1/share /mnt0'
'cd /mnt0'
'photorec'

If you suspect that your filesystem is corrupt, I would first try to run a chkdsk on it and see what it recovers. Then afterwards, see what show up and depending on what 's become visible, use the ntfs capabilities of TRK or use photorec... But do not run a chkdsk if your disk is physically dying!!! Try to do as little I/O possible on that disk. Running a chkdsk will probably render it even more unusable in that case.

Maybe ddrescue first

If photorec is unable to recover because of too many corrupt sectors, you can try ddrescue.
This util tries to recover files and filesystems that are on locations with bad sectors. If its really unable to read the bad sectors, it will pad them with zeroes. Your files will possibly be corrupted, but at least you 'll have saved whatever there is to save. If you ddrescue a complete filesystem (e.g. 'ddrescue if=/dev/hda1 of=/mnt0/rescued-image.img), you can afterwards mount that image as a loopback filesystem ('mount -o loop /mnt0/rescued-image.img /mnt1') and rescue/undelete files like that.

I didn't see any exe files. I don't know how to use open source. I mean it is not a usual download file.

Trinity Rescue Kit is a recovery CD
You download the .ISO (CD image)
and burn it to CD

Try making your hidden files visible and search your documents folder, temp directory and desktop for hidden files with Word icons. I deleted a file with some creative writing in it long ago and in trying to recover it stumbled across all these "phantom" backups lying around. No idea what kind of system they follow but it felt as if Word made them upon every save or some such. They might only be in the same directory as the file itself (thus deleted along with the folder) but you never know.

Thank you, the problem is solved. I fixed the file recovered from Recover My Files with WordFix.

Phew! My advice: backup in the future.