{"id":2287,"date":"2016-07-25T09:32:32","date_gmt":"2016-07-25T09:32:32","guid":{"rendered":"http:\/\/johncanning.net\/wp\/?p=2287"},"modified":"2016-07-25T14:01:21","modified_gmt":"2016-07-25T14:01:21","slug":"recover-an-accidentally-wiped-hard-drive","status":"publish","type":"post","link":"http:\/\/johncanning.net\/wp\/?p=2287","title":{"rendered":"Recover an accidentally wiped hard drive"},"content":{"rendered":"

About 48 hours ago I would have been mystified how anyone could wipe their entire harddrive. On Saturday I attempted to upgrade my installation of Linux Mint from 17.3 to 18. The upgrade path failed so I opted for the recommended path of doing a clean install.<\/p>\n

This need not be a big deal. My set up was quite simple:<\/p>\n

1. A Solid State Drive (100GB) on which I keep Mint and the software running on Mint.
\n2. A 2TB hard disk where I keep everything else. (I set up Mint to write Documents, Pictures, Videos etc. to this drive.
\n(3. I also have a 3TB My Clould to which I save pictures, so I didn\u2019t loose everything)
\n\"t2\"\"t2\"
\nFor some reason when installing Mint I chose the option to wipe the 2TB hard drive clean instead of the 100GD SSD.<\/p>\n

Fortunately, I had recently read Linux Format\u2019s Round up of rescue distros (Issue 209, April 2016) so I was mildly aware there might be an opportunity to get my data back. I opted to install testdisk.<\/p>\n

I\u2019ll cut out some of the things I tried to do, but this is the short version<\/p>\n

Open the Linux Terminal (CTRL+ ALT+ T)<\/p>\n

sudo apt install testdisk<\/code><\/p>\n

I then ran a utility inside testdisk called photorec typing into the terminal<\/p>\n

photorec<\/code><\/p>\n

See instructions at: http:\/\/www.cgsecurity.org\/wiki\/PhotoRec_Step_By_Step<\/a><\/p>\n

After selecting to recover the 2TB disk and choosing a location to save the recovered files then following is in process:<\/p>\n

Terminal view (I\u2019m hoping it will not take 24 hours to complete. It said 72 hours about an hour ago!)\"t5\"<\/p>\n

The program saved the recovered files into these folders.<\/p>\n

\"t7\"<\/p>\n

The obvious issue here is that the recovered files don\u2019t appear with their original file names and the folder structure is not maintained. However, there are some more important issues here:<\/p>\n

    \n
  1. This has been surprising easy to do. On one hand that is a good thing as it means I\u2019ve got my files back. On the other hand, the ease with which I recovered files demonstrates how insecure the process of wiping a hard drive is. Once anyone gets hold of the hard drive it is amazingly easy to recover anything that was on there.<\/li>\n
  2. This process retrieves everything including files I had already deleted and pictures from websites I had visited. For example some of the folders contain pictures of the people I follow on twitter, I did not download these.<\/li>\n
  3. When I say retrieves everything I mean everything. Most of the files retrieved are things like web buttons.<\/li>\n<\/ol>\n

    \"t6\"Anyway the main lessons here are as follows.<\/p>\n

      \n
    1. Check very carefully before you delete.<\/li>\n
    2. It is easierto recover files than I thought:
      \na) This is a good thing if you made a mistake.
      \nb) This is a bad thing it you actually wanted to securely wipe a drive. If you want to wipe a drive so no one else can       read it, some research is needed <\/a>. Deleting your files and reformatting is not enough.<\/li>\n<\/ol>\n

      Photorec: Step by step (also works with Windows) <\/a><\/p>\n

      Using python coding <\/a>to sort out the files afterwards (not tried yet!)<\/p>\n\n\n