Recover directory tree with files from win10 HD

[Polytropon]

On Tue, 10 Apr 2018 20:14:36 -0400, Ernie Luzar wrote:
> My mothers win10 pc has external usb 3tb sata drive with 600gb of data 
> that has hardware data problems. It will not mount on win10 pc.

Do not try any further with "Windows", it could do more damage.
On "Windows 10", they use NTFS or FAT as file systems, and both
are known to do the "funniest things" when getting into some
inconsistent state ("silent" data corruption, data loss, no
access due to damaged hiberfile, etc.).



> My 
> mother has her whole digital life on the external drive.

Just restore from backup! Sorry, couldn'r resist... ;-)



> I can not find 
> any win10 software to recover the data from a drive that will not mount.

First of all, use tools that work with a copy of the damaged
disk (or partition). Create this 1:1 copy first in a read-only
manner, then work with the image. Do not try to repair the
data "on-disk", it will probably destroy more data and reduce
the chances of getting the "whole digital life" back.

Seriously. I'm not making this up - I learned from my own
faults. Check the mailing list archives for the terrible
truth. :-)

Do not use "Windows" any further without knowing _exactly_
what the problem is.



> I am thinking about using FreeBSD to recover the directory structure and 
> the files contained in them. Asking anyone if they know of a port that 
> will recover the data with their full file names in their directories?

That depends on the actual damage. This is how you should
proceed:

1. Make a 1:1 copy of the disk or partition. Use that copy
   in all further steps. (Two copies are handy, in case you
   mess up one.)

2. Examine the data. What has happened? Can you use FUSE's
   NTFS mount program to mount it read-only? Can you use
   tools from the ntfs-tools package to repair things like
   the MFT. Or is it a FAT drive? Try mount_msdos instead,
   maybe even fsck_msdosfs. It could be sufficient to copy
   all the data (cp -R).

3. No luck getting the partition to mount? Assume the data
   is still there. Make yourself familiar with professional
   forensic tools. Start with the easy ones. If they get
   back what you expect to recover, well done. If not, use
   the more complex ones.

On this mailing list, I have published my "famous list of
data recovery tools" from time to time. Note that in order
to make use of that list, you'll have to learn (!) about
lower-level file system design, because you _must_ understand
what you're doing.

Here is this list. Note that I've added a few comments that
might help in your specific situation (damaged FAT or NTFS
drive):

System:
	dd			<- for making 1:1 copy
	fsck_ffs
	clri
	fsdb
	fetch -rR <device>
	recoverdisk

Ports:
	ddrescue		<- if 1:1 copy is hard
	dd_rescue		<- same
	ffs2recov
	magicrescue		<- get data back (no structure)
	testdisk
	The Sleuth Kit:
		fls
		dls
		ils
		autopsy
	scan_ffs
	recoverjpeg
	foremost
	photorec
	fatback			<- FAT
	ntfs-tools		<- NTFS (ntfsfix, ntfsinfo, ntfsmount)

Keep in mind: It will take time. There is no "one size fits
all" GUI solution where you just click and icon and then have
all your files (and the directory structure) back. IN worst
case, what you're searching for has already been overwritten
by "Windows" attempting to "repair" it.

Your alternative: Take $500-3000 and ship the disk to a
recovery business. If a "whole digital life" is worth that
much money, you can give them a change. Note that there is
absolutely no guarantee that they will succeed.

Good luck!





-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...