One of our teachers brought in an unusable portable 120GB HD (2.5"). It was not backed up and there is about 2 years worth of work stored on it. I have analysed the drive with several utilities and until I tried Testdisk was getting nothing usful from it.
Testdisk did a deep scan and found that the FAT had been deleted/corrupted somehow, but a backup had been found in a restore folder.
All the scans I've done so far are non-invasive as I don't want to risk overwriting anything; can anyone tell me if by restoring the FAT are we likely to lose any data - if so how much - I'm guessing not a lot.
I have tried cloning (using Clonezilla) it to an equal sized partition on another drive so I can do a dry-run, but without the FAT, nothing (apart from Testdisk) has been able to read it to clone it.
You could try downloading the helix forensics boot cd and using it's utilities to clone it, I presume a DD copy of the disk should succeed as that woudn't care about the fat.
There are currently 1 users browsing this thread. (0 members and 1 guests)