From owner-freebsd-questions@FreeBSD.ORG Mon Jul 9 20:49:36 2012 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 2DA011065809 for ; Mon, 9 Jul 2012 20:49:36 +0000 (UTC) (envelope-from wojtek@wojtek.tensor.gdynia.pl) Received: from wojtek.tensor.gdynia.pl (wojtek.tensor.gdynia.pl [89.206.35.99]) by mx1.freebsd.org (Postfix) with ESMTP id 8DB428FC1F for ; Mon, 9 Jul 2012 20:49:35 +0000 (UTC) Received: from wojtek.tensor.gdynia.pl (localhost [127.0.0.1]) by wojtek.tensor.gdynia.pl (8.14.5/8.14.5) with ESMTP id q69KnUKd044057; Mon, 9 Jul 2012 22:49:30 +0200 (CEST) (envelope-from wojtek@wojtek.tensor.gdynia.pl) Received: from localhost (wojtek@localhost) by wojtek.tensor.gdynia.pl (8.14.5/8.14.5/Submit) with ESMTP id q69KnUqY044054; Mon, 9 Jul 2012 22:49:30 +0200 (CEST) (envelope-from wojtek@wojtek.tensor.gdynia.pl) Date: Mon, 9 Jul 2012 22:49:30 +0200 (CEST) From: Wojciech Puchar To: Graeme Dargie In-Reply-To: <4C0F7421AA759346AF17299922AD57EB06286449@Mercury.universe.galaxy.lcl> Message-ID: References: <4C0F7421AA759346AF17299922AD57EB06286449@Mercury.universe.galaxy.lcl> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.2.7 (wojtek.tensor.gdynia.pl [127.0.0.1]); Mon, 09 Jul 2012 22:49:30 +0200 (CEST) Cc: "'freebsd-questions@freebsd.org'" Subject: Re: NTFS data recovery X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Jul 2012 20:49:36 -0000 > I have been given a laptop to look at for a friend, the hard disk is close to death with a SMART error on POST. My initial thought was to just mount it on an Windows 7 machine and grab what I can from the drive. No joy Windows insists that the partition is RAW and I need to format it. I can however mount it under FreeBSD without any problems, the directory structure appears to be intact but there are no files in the places I would expect to find them under the Users directory, I am guessing that these have somehow been deleted or perhaps the victim of a partial OEM recovery process. Is there a way to scan the drive for deleted files from the command line or something from the ports tree that anyone can recommend to fulfil this requirement. get other disk or just use free space on large filesystem and do dd if=/dev/baddisk of=file bs=64k conv=noerror,sync then - after having backup, try to salvage things