[CoLoCo] Urgent Help Needed: File system screw-up

[Neal McBurnett]

On Tue, Aug 21, 2007 at 06:29:43PM -0400, Ringo Kamens wrote:
> I booted the
> ubuntu live cd, disabled automounting, and did "sudo gparted". I then
> went to /dev/sda12 and chose "format to" ext2 thinking it would
> convert the partition, not completely erase it. Now I can't see ANY of
> my data and this was over a year of work I had on there and I urgently
> need some of the files.
> 
> The good news is, only the partition table has been overwritten and I
> think I can recover most of the data but I don't know how. Does
> anybody have any suggestions? I would *really* appreciate any help you
> could give me on this, seeing as how important it is that I get this
> data back.

Ouch.

First rule I'd suggest - don't change that /dev/had12 partition at all
now - don't mount it read-write at all.  Copy the bits to another
partition via something like `sudo dd if=/dev/had12 of=/some/file`
and try all your recovery tricks on the copy.  /some/file would
ideally be a partition, but could just be a regular file that you
mount in loop mode to play.

The "strings" command will show you stuff there.  Beyond that, you'll
need some good forensics tools, which I know little about....

-Neal