-1

A 60 GB external USB drive was formatted by someone. I copied the bytes one-by-one by dd command to a file and named it backup.dd file. Then I used photorec to recover the files. Many smaller files are recovered except one specific big mpeg video.

The strange thing is that the largest recovered file is a swf flash file of 1.6 GB in size which shouldn't be there. Nobody remembers such a file. That's strange.

Anyways, what else can I do to recover the missing file?

UPDATE

The missing mpeg video which is not recovered by any tool, should be the largest one. It should be larger than 2 GB or 3 GB.

Looks promissing

The Wondershare Recoverit software suggested by the accepted answer is actually showing me the big videos which I was looking for. I'm seeing them, but I cannot push the recover button since I didn't purchase the software yet. It looks promising:

Wondershare Recoverit screenshot: found big videos

Megidd
  • 261
  • 3
  • 15
  • Send it to a data recovery service. Compared to a 1GB file, a 25GB is going to be spread over a much wider area of the drive, in an unknown number of fragments, making the relevant data sectors much harder to identify. – Tetsujin Nov 07 '21 at 17:15
  • @Tetsujin The total size of the formatted USB drive is 60 GB! – Megidd Nov 07 '21 at 17:18
  • @Tetsujin No, I meant that the total size of the recovered files is `25 GB`. And total capacity of the formatted USB drive has been `60 GB`. – Megidd Nov 07 '21 at 17:20
  • I misread. I thought you had one missing 25GB file. – Tetsujin Nov 07 '21 at 17:20
  • @Tetsujin What tools are used by a data recovery service? Can I use them myself? Are the tools available online? – Megidd Nov 07 '21 at 17:21
  • They don't tell you. No. No. ;) – Tetsujin Nov 07 '21 at 17:43
  • @Tetsujin Well, makes sense, I guess. – Megidd Nov 07 '21 at 17:56
  • https://www.r-studio.com has two free windows programs, and a free trial of their proprietary software "R-STUDIO" (which is limited to recovering only small files until bought). I tried 3 recovery programs recently on a drive where a failing disc corrupted the file system, and it was the only one that showed one important file as recoverable before I bought it, which it in fact did. It happens to be on special for Black Friday at the moment. (Judging by the fact it integrates with DeepSpar hardware, it's probably what many smaller data recovery companies use.) Just my two cents. Best of luck. – Stax Nov 25 '21 at 04:16
  • @Stax I tried R-Studio. Upon recovering, it demanded a license purchase :( – Megidd Nov 25 '21 at 08:08
  • @Stax Also, I'm not sure if R-Studio found my big files correctly. The file names are all messed up. There was no info about file sizes! – Megidd Nov 25 '21 at 08:09
  • 1
    "License demanded": I DID say "proprietary software "R-STUDIO" (which is limited to recovering only small files until bought). The other programs which are free are less capable. "names messed up": Well, R-Studio may not be your best bet then. From memory, I believe there is an option somewhere (rightclick?) once a file is selected to confirm it IS recoverable. Maybe try a program from another company which has a "money back guarantee", unlike R-s. Have you tried "Recuva" free version with DeepScan and Non-Deleted files. – Stax Nov 26 '21 at 03:04
  • @Stax Thanks for introducing *Recuva* free version :) I may try. – Megidd Nov 26 '21 at 04:21
  • @Stax I tried *Recuva* free version with options of *DeepScan* and *Non-Deleted*. Unfortunately it couldn't find the files I was looking for! – Megidd Nov 26 '21 at 04:50

2 Answers2

1

This might not be practically doable. What has likely happened is the file has been dispersed over multiple parts of the disk, with the filesystem being used to link the parts. This indexing has likely been destroyed when the file system was formatted.

Photorec and similar work by looking for file signatures and then reading as much as they can. This works well for images and videos where there is no fragmentation but breaks down where the file is fragmented.

In order to further your endeavours you have the very difficult (almost impossible) task of finding the missing fragments and reassembling them. It may depend a bit on the format of the mpeg video, but if its a highly compressed format, there are likely to be very few, if any, markers to help with this.

I've never tried it, so its not a recommendation but the advanced version of Wondershare Recoverit purports to be able to scan, match and merge video fragments. The reviews seem to indicate its legitimate, but be careful of automatic rebilling of your credit card each month if you don't cancel.

davidgo
  • 68,623
  • 13
  • 106
  • 163
  • The **Wondershare Recoverit** is showing me the missing large videos. But I didn't purchase the software yet. So, I cannot push the *recover* button and see the final result. I'm looking for a *trial try*, so that I can be sure about the final recovery. – Megidd Nov 25 '21 at 03:34
0

Finally, with Wondershare Recoverit, 1h17m out of a 1h27m video is recovered. Meaning only the last 10m of the video is not recovered.

Timeline of what I tried

  1. The first thing I did with the formatted external drive was to make a copy of the raw data by:
sudo dd if=/dev/sdb of=backup_vfat.dd status=progress
sudo sync
  1. The backup_vfat.dd file was more than 60G. I placed it inside a Windows drive and ran Wondershare Recoverit on the whole drive. This way, only 27m of the 1h27m video was recovered. The details are here:

A video of 1h27m duration, only plays up to 27m

  1. I used dd command to copy the raw bytes into an external drive by:
sudo dd if=backup_vfat.dd of=/dev/sdb status=progress
sudo sync
  1. I ran Wondershare Recoverit on the external drive. Then, 1h17m of the 1h27m video is recovered. I don't have the last 10m of the video. That's the best I could do.
Megidd
  • 261
  • 3
  • 15