Recovering broken or deleted NTFS partitions

Disclaimer: I provided an answer to similar questions here and here. This is a summary of those two answers. Moreover, I am the developer of RecuperaBit.

Your NTFS partition is broken. In order to restore the data, you need to make a copy of it (ideally) and then use a NTFS reconstruction software to restore its contents.

Clone the drive

You really should clone the drive in a file on an external disk, unless it is so big you can't find another drive than can contain it.

If you are really sure the NTFS partition coincides with /dev/sdb2, then use ddrescue to copy only that one:

sudo ddrescue /dev/sdb2 /media/user/External/copy.img /media/user/External/status.log

If you are not sure, it is much better to clone the entire /dev/sdb drive. This will take more space, of course:

sudo ddrescue /dev/sdb /media/user/External/copy.img /media/user/External/status.log

The status.log file is not mandatory, but it is needed if you want to pause the process and resume later on.

Analyze and reconstruct the file system

If the file system is only slightly broken, you may have luck with testdisk:

testdisk /media/External/copy.img

Follow the step-by-step procedure in the CLI and you will be able to list the contents of the partition with the P key, assuming it is almost intact.

If the damage is more serious, you need something else. You can recover (possibly severely) damaged NTFS partitions using RecuperaBit. RecuperaBit attempts to reconstruct file system structures and recover files. RecuperaBit attempts reconstruction of the directory structure regardless of:

• missing partition table
• unknown partition boundaries
• partially-overwritten metadata
• quick format

Currently, it does not require installation, you need to download the archive from GitHub and extract it in a directory of your choice.

After that, create a directory for the output and start the program with:

mkdir /media/user/External/recovered_files
cd [full path of recuperabit]
pypy main.py /media/user/External/copy.img -o /media/user/External/recovered_files -s /media/user/External/savefile.save

You might also use python, however pypy is faster. The scanning process will take quite some time. When it's done, type recoverable and find the id of your partition. If it is e.g. 2, type:

restore 2 5
restore 2 -1

5 means the Root directory and -1 means the Lost Files directory.

For additional details, explanations and caveats, see the two links at the top of this post.