Jump to content

Full drive recovery


Urza9814
 Share

Recommended Posts

So I decided I wanted to play a windoze game and went to install XP.

I told it to format hdb1.

It decided to format hdb1 and all of hda.

My entire linux install, 300GB , two partitions, / and /home, are now reading as one giant empty partition.

I have no recent backups.

Any ideas for how to recover anything?

 

edit:

So I was advised to run a 'strings /dev/hdc|more' to see if the stuff was still there, and that brought up a short layer of windoze error messages followed by a bunch of mandriva filenames and such. So what's my best chance for recovery?

Edited by Urza9814
Link to comment
Share on other sites

Get a livcd like knoppix that has gpart and parted included. Parted has some partition recovery tools that you can try and gpart is a utility for reconstructing damaged or deleted partition tables. The general procedure is described in this howto which is geared toward ubuntu but it can be adapted for knoppix:

 

http://ubuntuforums.org/showthread.php?p=2210436

 

Here's another link that deals with gpart usage:

 

http://enterprise.linux.com/enterprise/06/...d=47&tid=89

 

It doesn't work all the time and these tools don't work so good with recovering extended partitions, but it's worth a shot.

Edited by pmpatrick
Link to comment
Share on other sites

gpart found nothing.

testdisk immediately found one deleted Ext2 partition, but only one. I told it to search more though. Hopefully it'll be able to dig up my /home.

 

edit:

It looks like it's only gonna find my root partition. If I only restore that, will it affect my chances of recovering anything from my /home?

Edited by Urza9814
Link to comment
Share on other sites

test disk comes with photorec which should be able to recover most all your files. I recently used it on my son's system after a partition was inadvertently reformatted. The problem was that while the files were recovered the file names were not. This may or may not be a problem for you.

Link to comment
Share on other sites

Well, it seems to detect all the partitions, but I'm still having problems. I had to run the scan at the lowest speed (which takes around 10 hours) and ended up with this:

 

TestDisk 4.2, Data Recovery Utility, August 3 2002
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/hdc - CHS 36483 255 63 - 286181 MB
Use arrow keys to change partition characteristics (see below)
Press the ENTER key to continue
Partition				 Start		  End	   Size
D Linux ext2fs			 0   1  1  7676 254 63  123330942
D Linux ext2fs			 2  29  9  7678 254 63  123329170
D Linux ext2fs			 3  78  5  7679 254 63  123326087
D Linux ext2fs			 3  88  1  7679 254 63  123325461
D Linux ext2fs			 3 142  1  7679 254 63  123322059
D Linux ext2fs			 3 146  1  7679 254 63  123321807
D Linux ext2fs			 3 242  1  7680 254 63  123331824
D Linux ext2fs			 4  47  1  7680 254 63  123328044
D Linux ext2fs		  7766   1  1 36482 254 63  461338542
D FAT32 LBA			13157 118  1 13288 254 63	2113146
D OS/2 Boot Manager	18511  34  1 18512 254 63	  29988
D Linux ext2fs		 18517  34 17 18517 254 63	  13907


Structure: Ok  Press 'T' key to change partition type, 'P' to list files
*=Primary bootable  P=Primary  L=Logical  E=Extended  D=Deleted
EXT2 Sparse superblock

 

However, when I hit enter to continue, I get the following blank screen:

TestDisk 4.2, Data Recovery Utility, August 3 2002
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/hdc - CHS 36483 255 63 - 286181 MB

 Partition				   Start		  End	   Size














 Quit	 Write


						   Quit this section

I then of course choose quit so I don't write nothingness. Any idea what I'm doing wrong? I currently have everything on the default settings. Could I perhaps restore with another program now using this information?

Edited by Urza9814
Link to comment
Share on other sites

If you don't format it, with that listing of partitions and their start and end sectors, you (I believe, don't kill me if this fails) should be able to use any partition manager (that does all the FS types) to recreate the partitions by entering the exact configuration (start and end sectors) of each partition.

Link to comment
Share on other sites

I'd agree with that, using fdisk for repartioning the start sectors have to be the same else you lose the data. If you get this all right, and maybe, just maybe, you'll be able to mount the partitions and get at the data.

 

Let's hope it works in your favour!

Link to comment
Share on other sites

Ok, well i'll try that, but I need a bit of help on how. The only partition program I've ever used is the one on the mandriva installer (I use that for everything) and the testdisk documentation that I'm finding doesn't really explain this well. What are all those numbers under 'start' and 'end'? I'm guessing the last one is size in bytes, but that doesn't match up to the total drive size. I'm getting that the two partitions I want are 0-7676 and 7766-36482, but what are those numbers? cylinders? I'm also not sure if the second partition is primary or extended. Will that matter for this?

 

Does this look right? I'm modding from a page I found on fdisk...

 

> fdisk /dev/hdc
Command (m for help): n
Command action
  e   extended
  p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-22800, default 1): <RETURN>
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-22800, default 22800): 7676

#...and then repeat that for 7766-36482

Link to comment
Share on other sites

Oh, oops. That's not an actual screengrab, I pulled that off another website just to see what I'd be doing. I never changed the values to reflect my hardware.

Edited by Urza9814
Link to comment
Share on other sites

Well, that failed. And I figured out how to use testdisk, you have to select the partition and use the arrow keys to change the type, but that failed too. So I've decided I'm gonna just reinstall on my old 200GB disk, since the /home is still intact, even though it's a bit small, and try to get any data I need over the next few weeks off with photorec or something, then just transfer it back over at some point.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
 Share

×
×
  • Create New...