Recovery

[Dr. Sharukh K. R. Pavri.]

On Tue, 30 Jan 2007, Lokeey wrote:

> i haven't done anything to fix it yet...i'm still looking for a tool to help
> me extract the data that's on that partition...i think what the partition is
> missing is a kde startup file, but i'm not 100% sure...also, when i received
> the first batch of errors, i fan fsck
> 
> to answer your other question, what i originally did was format the
> partition that i thought was empty and not being used.

Ouch :)

First rule of recovery ---  use your backups -- you _do_ have backups
right ?

Second rule --- don't even mount the hard disk you are trying to recover
data from. Disk sync'ing _can_ play a bit of avoidable havoc.

One way to go would be to attach another hard disk to the machine and use
dd to copy over the entire partition to the new disk.

Say your original hard disk is hda (priamry master) and you have attached
a new disk at hdb (primary slave) and say your affected partition is hda2.

Boot from a live cd, anything should do, a kubuntu live cd or a knoppix cd
or even one of the tiny linux distros like rip or tomsrtbt.

Create a partition on hdb say hdb1 of the same size as your deleted
partition if possible or larger but definitely not smaller.

make sure both hda and hdb are unmounted. use the mount command to check.

then do 

dd if=/dev/hda2 of=/dev/hdb1 bs=1024

once that is done you will have a bit by bit raw copy of your original
partition at hdb1. Mount this and do all your recovery attempts on this.

If you do not want to fiddle with the partitions on hdb and you have an
empty partition larger than hda2 you could also do

dd if=/dev/hda2 of=/dev/hdb1/backup.iso bs=1024

you will then have to mount backup.iso on loopback. How to do that is
left as an exercise to the reader :)

also take a look here 

http://www.cgsecurity.org/wiki/TestDisk

let us know how things work.

usual caveats apply -- you will do everything at your own risk. If you
have data that you just cannot do without, you may want to look at some
professional services.

regards,

Sharukh.

> 
> 
> On 1/30/07, Dr. Sharukh K. R. Pavri. <lists at pavri.net> wrote:
> >
> >On Sun, 28 Jan 2007, Lokeey wrote:
> >
> >> i was wondering if anyone knew of any good tools to recover data from a
> >hard
> >> drive? i accidentally erased what i thought was unused partition that i
> >> think had the boot label now the main partition where all of my linux
> >data
> >> was on is not able to mount or do anything else for that matter. i just
> >want
> >> to be able to removed the data from the partition so that i can
> >reinstall
> >> kubuntu.
> >>
> >> any ideas?
> >
> >I'm coming into this thread a little late, but what have you done ?
> >deleted the partition entry or formatted the partition ?
> >
> >anyway take a look here
> >
> >http://www.faqs.org/docs/Linux-mini/Partition-Rescue.html
> >
> >I remember I had some links somewhere but can't find them just now. I'll
> >hunt for them and send them if I find any.
> >
> >hth,
> >
> >Sharukh


-- 
Dr. Sharukh K. R. Pavri.  			Homoeopath, Linuxer.
 I hope you're not pretending to be evil while secretly being good.
                      That would be dishonest.