Lazza / RecuperaBit

A tool for forensic file system reconstruction.
GNU General Public License v3.0
517 stars 73 forks source link

Gave me an error after typing "tree" and exited #102

Closed languagemaniac closed 2 years ago

languagemaniac commented 2 years ago

Hi, I run recuperabit on a ~500gb hdd image I made of a failing hard drive partition with ddrescue. I stopped the image creation at 83% because It was going too slow for days.

I put that image in recuperabit on a computer with 48gb of physical ram, and it spent over a day doing its thing.

When it finished, I typed "recoverable" and it listed a very long list of partitions (Don't know how this works but the image file was just 1 partition and this listed dozens of them). Partition number 12 was about 466gb and contained thousands of files, while the rest contained very few files, so I then typed what I think caused the error.

I typed "tree 12", probably missed a hashtag, or something, I just typed it and it quickly gave me an error saying something like "couldn't find UNICHAR XXXXX on line XX (could have been "19"). And then it exited.

At the moment, I was kind of desperate and didn't stop to take a picture of the error, so that's what I can recall. The initial command I typed was the following:

pypy3.exe main.py X:\file.img -o Z:\outputdirectory\ -s Z:\recuperabit.save

(I run this command previously on another computer and it went throguh the first scan phase successfully, so I loaded the savefile on the other computer that had 48gb of ram)

Is there anything I can do to get to the part where I can try the "recovery" and "tree" commands again without having to go through all the process again? Starting that same command looked like it was going to start the process all over again :')

I will try it again from the beggining if it's necessary, in which case I'd like to know what should I do to recover the data in partition number 12 without recuperabit giving me an error and exiting. Thanks!

slavanap commented 2 years ago

I recommend to rerun command and wait. If save file exists at the location specified, then the process is much faster - it reads and parses the file again, but don't scan entire drive, which may look like a rerun, but it's not.

IMO, without full error message text it's going nowhere.

Lazza commented 2 years ago

Is there anything I can do to get to the part where I can try the "recovery" and "tree" commands again without having to go through all the process again?

You can skip most of the disk reading with the savefile, but the tree reconstruction currently is ran every time. I know it is not ideal, but I still need to find the time to implement a proper database file.

what should I do to recover the data in partition number 12 without recuperabit giving me an error and exiting

I am sorry that it crashed. Can you please provide the complete error message? It could have to do with Unicode, although most Unicode problems have vanished since migrating to Python 3.

languagemaniac commented 2 years ago

I am sorry that it crashed. Can you please provide the complete error message? It could have to do with Unicode, although most Unicode problems have vanished since migrating to Python 3.

No need to be sorry! Thanks for your reply. I will try to rerun the command, if I get the error again I'll make sure to copy it. I will need some time until I can do that, maybe next week

Lazza commented 2 years ago

I will need some time until I can do that, maybe next week

Sure, no problem. You are speaking with the developer who about 1 year ago said "I am going to rewrite the save file into a proper database". 😇

languagemaniac commented 2 years ago

I will need some time until I can do that, maybe next week

Sure, no problem. You are speaking with the developer who about 1 year ago said "I am going to rewrite the save file into a proper database". innocent

So This whole thing was to recover a friend's hdd, but it turns out he had a backup on an external drive that was also failing, but he sent it somewhere and managed to recover it, so I won't be needing to use recuperabit for this project anymore.

Maybe the error was caused because the partition that I had imaged, wasn't imaged to 100%, it got stuck at 82.xx% using ddrescue.

It was the most promising tool for recovering the data though, I will note it down for the future.

Sorry I can't provide more information for this error, hopefully it will get sorted out soon.