#testdisk

Sicuramente vi è capitato qualche volta di trovare in fondo ad un cassetto una penna usb, una memoria, un hard disk, provarlo e accorgersi che non è più leggibile. Magari su quel supporto vi sono documenti che vi interessano, fotografie che vi sono care o magari avere solo la curiosità di sapere cosa c’era. Ebbene se il supporto non è fisicamente rotto oppure non è stato sovrascritto esiste un…

What a week! My car is also misfiring on a cylinder, and this morning I discovered both data drives on my home server showed “unallocated partition and filesystem”. This I discovered after plugging them into my desktop computer, and they did not even show up as drives. I managed to see the lack of partition and filesystem when using GParted (partition manager) to view them. This was not good!

The first rule of data recovery though is “Don’t Panic” and also don’t write anything or try formatting the drive. Invariably, the actual data is still on the drive, as usually it is the partition or boot sectors that are damaged in some way.

My home server boots off an SSD drive and has two 4 TB USB drives connected. One USB drive is the primary data and stores the container volume data (the config and working data for the Docker containers that run off the boot drive), and the second USB drive is a daily Rsync of all the data on the primary drive.

So, I made a cup of coffee while my heart rate was returning to normal and thought about the problem. At first, I thought it could be a hack as why would both drives fail together, but the boot drive was all OK and the logs showed nothing. My server does sit behind Cloudflare, a home router firewall, as well as Nginx Proxy Manager, and has Fail2Ban running. So, I began to think this was maybe not the case.

The logs showed fails at around 00:30, and I recalled the grid power came on around 00:10 (this is in South Africa) and may have had some sort of power spike. I thought originally this was unlikely though, as everything runs off a solar inverter, and it should have cleaned anything from the power side. The other computers were all off, but the system has survived hundreds of such power cycles over the last few years without issues at all.

But after neither drive showed any sign of life after being connected to my desktop PC, I found another USB-SATA adaptor which I connected up to one of the drives. I could now hear it spinning, but Gparted showed the unallocated partition and file system message. But this was good, as at least the drives still spun.

So, I tried TestDisk and its job is initially to search for partitions on the drive, which it did find, and then it allowed me to start browsing files. So that was great, as the files did show. What TestDisk then can do (amongst many more functions) was to then rebuild the partition table. After that, the drive appeared in my file manager, and I could view/copy the files. TestDisk may seem intimidating, but it is wizard driven with suggestions and advice, so you just really need to read each screen carefully.

But putting the original USB-SATA adaptor on again, seemed to once again trash the partition table. So, after another recovery, I used the backup USB-SATA adaptor that I still had and could place that drive back in the server, and it was working perfectly on the primary data disk now.

So off to the shop and I had to buy two new drive enclosures (that have the USB-SATA adaptors inside). I fitted the backup drive to one of those enclosures, and it is also now visible. OpenMediaVault was just moaning about the change of drive ID (supposedly because of the different SATA controller) but it settled down, and I could run a fresh backup to the drive.

So, in conclusion, it seems the USB-SATA adaptors were both trashed by probably some form of power issue that struck through the USB ports (although the main SATA SSD drive was fine). So, I’ve dusted off a disused APC UPS out of the cupboard and will rather run that server off that UPS to add some more cushioning for it.

I could consider again running a backup, possibly over the Ethernet network at night, to better separate the storage devices.

TestDisk is OpenSource software and is licensed under the terms of the GNU General Public License (GPL v2+). It is powerful free data recovery software that was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table).

なぜかわからんけど、サーバのRAID0を組んでいるメンバディスクの1本が、GPT情報が壊れて、アレイから外れてしまった。

以下、復旧ログ

amzn_assoc_ad_type = "banner"; amzn_assoc_marketplace = "amazon"; amzn_assoc_region = "US"; amzn_assoc_placement = "assoc_banner_placement_default"; amzn_assoc_campaigns = "amzn_vicc_cloudcam_1017"; amzn_assoc_banner_type = "category"; amzn_assoc_isresponsive = "true"; amzn_assoc_banner_id = "1J0CHGJT75D586M66602"; amzn_assoc_tracking_id = "kraljevicn1-20"; amzn_assoc_linkid = "c122cc4768b349b4aab7d3099b74ea1c";

Sunday Round up for this week!

Articles:

Im publishing an infosec book

Looking back at the Snowden revelations

Google quantum computing document leak.

Pwnedbg - debugging the ios kernel in ida.

Investigating Kik Messenger In Oxygen Forensic® Detective

If you found some other interesting stuff this week feel free to leave a link to it in the comments section. Otherwise feel free to check out the last roundup here.

amzn_assoc_ad_type = "banner"; amzn_assoc_marketplace = "amazon"; amzn_assoc_region = "US"; amzn_assoc_placement = "assoc_banner_placement_default"; amzn_assoc_campaigns = "amzn_vicc_cloudcam_1017"; amzn_assoc_banner_type = "category"; amzn_assoc_isresponsive = "true"; amzn_assoc_banner_id = "1J0CHGJT75D586M66602"; amzn_assoc_tracking_id = "kraljevicn1-20"; amzn_assoc_linkid = "c122cc4768b349b4aab7d3099b74ea1c";

Sunday Round up for this week!

Articles:

Im publishing an infosec book

How to Recover Deleted Files Using TestDisk in Linux

Revisiting Software Vulnerabilities in the Boeing 787

Dr0p1t-Framework

secrary/Andromeda: Andromeda - Interactive Reverse Engineering Tool for Android Applications

If you found some other interesting stuff this week feel free to leave a link to it in the comments section. Otherwise feel free to check out the last roundup here.

We’ve all been there – a vitally important file goes missing, fails to save, or freezes, and there seems as if there is no way back. It’s a nightmare scenario with a crucial deadline looming. But fear not, as all is not lost. Fortunately there are ways of recovering what appear to be permanently deleted files on Windows platforms, you just need to know how. You see, the thing is, even when you permanently delete a file from your device, you actually don’t. That is, your machine simply makes it invisible to you and moves it with the purpose of freeing up space for other things. With this knowledge, you can see that recovering files is just a case of unlocking the mystery of where the said file has been moved to. Here’s how.

From your recycle bin

Many people delete files using the ‘right click’ function, which is not a permanent solution in any case. If this is what you have done, then retrieving your file is child’s play. Simply go the recycle bin on your device, search for the document in question, right click again and select ‘restore’. This then moves the file back to it’s original location, and you are good to go. It’s a simple as it gets.

From previous versions

If you haven’t ‘right-clicked’ to delete, then it gets a little more complicated, but don’t worry, there are still ways of getting your work back. This involves accessing a previous version of the document. The only thing that is required here is knowledge of the file name – once you have this information, you are good to go. Start by opening a new file, and give that file the name of the ‘lost’ document. Next up is that faithful ‘right click’ and then scroll down to the ‘restore previous versions’ option which will be displayed. It’s then just a case of clicking on and restoring the last version before the document was lost. This is a great method for those who don’t consider themselves to be tech-heads. In fact, I regularly use it myself.

The software option

Sometimes the previous options as listed here just don’t come through for you, so next up is the software option. Of course this prolongs the activity, but getting that important file back is the objective, and nothing else matters. People are often reticent about using software for this activity, but my advice is always the same: use it. Not only are these software solutions clean to install and uninstall, they do the job that is required. What is not to like? These software solutions work for all types of files too, from videos to images to word documents and excel files. Here’s how you can do it: First up, download the necessary software option. There are so many to choose from, so do a little research first and check out a few forums to see what people are saying the pros and cons are. If you really want us to suggest some, we vote for EaseUS Data Recovery Wizard, Recuva and TestDisk: all of these are very reliable and offer a free working version available to download. Now, install it and open it, and you are ready to go. Usually the first prompt is to select the type of file that you need to recover. It’s an easy first step. Next up you will probably need to identify the location on your device where the document was lost from. The idea here is that a scan will be performed by the software in order to find the file, so you need to narrow the search by showing the software the direction to move in. So, for example, if you have accidentally permanently deleted a document from your recycle bin, then the recycle bin is that place to direct the software. Now it’s time to run the scan, so follow the prompts that activate this. The search runs, and this can take a bit of time, depending on how much is already stored in the identified location. Be patient, the job is happening. With any luck, your file will now have been identified and listed on the search results box no shown. Select the file, restore it, and you are back in business As a final step, don’t forget to resave the file immediately in a convenient place. There’s nothing to fear and everything to be won from this solution. From beginning to end it can take no more than five minutes, which is really nothing in relation to having to restart the document from scratch, which may not even be possible anyway.

Conclusion