Ask for help restoring my data files [solved]

[klemm]

The other day I inserted the ARK disk in my and thought that I can fire it to my spare partition to see that distro. Only the system did hang with error and just after I notices that it had taken all my live system with it. It destroyed the partition set I had on the disk and replaced it with something.

 

 

How do I see it ?

 

HD is Maxtor Diamond Max Plus 8

OS was Mandrake 10.1 Official.

 

Previously I had partitions as following

hda1 = / (ext3) (~8,5Mb)

hda5 = swap (517mb)

hda6 = /home (ext3)

hda7 = /home/__username__/archive (~6Mb) (ext3)

 

 

Now I have them

hda1 - 321mb swap

hda2 - 39mb (ext2)

hda3 - the rest of disc

 

 

I scanned the harddrive using gpart and it told the following

 

Possible partition(Linux swap), size(321mb), offset(0mb)

Possible partition(Linux ext2), size(39mb), offset(321mb)

Possible extended partition at offset(9091mb)

Possible partition(Linux swap), size(517mb), offset(9091mb)

End scan.

 

 

From that I read that an offset of 9091mb + 517mb the previous home should start.

I don't care about the system area I had. its no problem to reinstall, but I care of the area that used to be my /home and I really want to get the data out that was there...

Only question to me is still how to restore the data ?

 

I feel sort of dumb in this area, it is complicated thing, have not had anything to deal with restoring systems, but I'd like to learn it and do it until I have some hope to restore the data files

 

I ask your help here, I am afraid of doing any false things that can destroy my data forever....

 

Where to start, what needs to be done and how I can try to restore it?

 

Kristjan

[klemm]

what might be a chance to restore my data files from a hard drive where the MBR and partition tables are messed up.

What there can be done.

 

I thought to use the fsck utilities but have no luck as the existing partitions do not point to the places where the partitions actually were.

My /home also located on an extended not a primary partition if that makes any difference.

 

Only thing I have managed to do is doing a backup of the disk using "dd"

 

Is there possibilities to use some undelete programs or by reading the data from/to some sectors

I have tried to google and read some man pages and topics but I am still clueless.

I don't know how to restore data when the partitions are changed already. hda6 where my home was, does not even exist.

 

Can anybody help me please with this !!!!!!!

[adamw]

You need to know what the layout of the partition tables was, _precisely_. Then you can use fdisk to manually recreate the table (this part is hairy). You can also try using gpart , which can help in these situations:

 

http://www.stud.uni-hannover.de/user/76201/gpart/

 

There's some useful instructions on that page too.

[klemm]

You need to know what the layout of the partition tables was, _precisely_.

 

Gpart gives the following information and it has found some start points for me also the swap at offset of 9091mb

just after that there should have been my /home partition (ext3) that I am looking for.

Possible partition(Linux swap), size(321mb), offset(0mb)
Possible partition(Linux ext2), size(39mb), offset(321mb)
Possible extended partition at offset(9091mb)
Possible partition(Linux swap), size(517mb), offset(9091mb)
End scan.

is that something that can be used for guessing the partitions.

I know how the disk partitions layout was. but not exactly.

 

Also I can loose everything else except the area that was the home before.

"Possible partition(Linux swap), size(517mb), offset(9091mb)" = hda5 in my previous schema

starting with 9091mb + 517 Mb should be my hda6 that used to be /home area that I need

I do not understand why gpart did not find anything regarding the partition that came after the swap.

 

Can that data be used someway to recreate the partition?

 

If I have used command dd if=/dev/hda of=/my/file ... then can I use that backup to write the data back in case I screw up and start over ?

[adamw]

Can you give as much as you remember about the previous partition layout? What partitions you had, in what order, and how large they were?

[klemm]

Can you give as much as you remember about the previous partition layout? What partitions you had, in what order, and how large they were?

 

hda1 9091 Mb ext3 /

hda5 517Mb swap

hda6 ~25G ext3 /home

hda7 ~5-6G ext3 /arcive

 

disc total about 40G

[klemm]

I thought I deserve them all

 

 

I never believed that a desparate screwup can have an easy solution.

I read about a tool named "testdisk".. I booted up knoppix and it was boundled there

So I started it, it scanned the hd and showed me my home and two other partitions.

I accepted the proposed layout to recover and restarted....

All my data I thougt to have lost is back again. I am now coying the files to my new box

 

So testdisk is worth fireing in case any of you get into similar mess.. I hope none of you do

Recovering has never been so easy

 

 

edit:

the name of the tool was actually testdisk

see http://www.cgsecurity.org/index.html?testdisk.html

Edited April 21, 2005 by klemm

[adamw]

heh, I knew there were some other tools besides gpart but I couldn't remember what they were all called :). good job!