Drive recovery using Linux??

[andrea phillips]

i cant get on my computer losdt user password and dont know how to reset it  can you help with a blow by blow account .

Bart Silverstrim <bsilver at chrononomicon.com> wrote:  Andrew Zajac wrote:
>> The problem I'm wondering about (the image from dd is almost done) is
>> the filesystem...the mount example is trying ext3, when I tried mounting
>> the drive physically fdisk couldn't determine the existence of a
>> partition table, and no filesystem.
>>
>> Any way to extract if there was a filesystem and it's just damaged?
> 
> If dd completed without error, then that's pretty good. Tools like
> rr_rescue and dd-rhelp (or the even better gnu dddrescue) are used to
> make an image of a failing drive while ignoring read errors. If dd
> completed on its own, then the drive is probably okay. 

DD completed. I was totally mistaken on the size, though; it was a 160 
gig drive. Took awhile to get done...

>Why it's
> partition table is gone is a mystery. Could the DVR have gone haywire
> and formatted itself?

No idea. I was just handed the drive and asked to look at it. I was 
then told that it wasn't worth my time to keep looking at it, so if it 
was nothing obvious then they were writing it off.

> If you are confident that the image you made is intact, you can try
> working on the physical drive to fix the partition table. I say this
> because you imaged the whole device. You cannot mount the whole
> device, but only the filesystem on the first partition of the device.
> I don't know what kind of partition table or filesystem your DVR uses.

No partitions were found. I did a dd if=/dev/hda 
of=/mnt/win/myshare/driveimage.img and it had completed fine (I'm never 
sure when to dig through finding what blocksize to use, but since it 
didn't thrown an error I didn't worry about it).

The utility testdisk found 2 HFS partitions, but i suspected they were 
false positives:
a) it said they were unrecoverable
b) the sizes were in the terabyte range, thus throwing another error 
about being too darn large for the size of the drive
c) HFS on a Panasonic DVR device? (this DVR is recording security 
cameras, not episodes of LOST)

So...I doubt it.

> Testdisk or parted can detect and add partitions found on the disk
> that are not part of the partition table. You can try that.

Whoops, replied too soon :-)

> If you are unable to detect or guess what partition goes where, you
> can always try to data-carve the files from the raw image or device.
> Photorec and foremost are very good at doing that. You can data
> carve a lot of the data on a disk even after it has been formatted.

I tried foremost with the "all" switch handed to it...nothing found.

There's something on the device, because strings /dev/hda |more found 
patterns to report on the dd image.

I guess the higher up doesn't want more time spent on recovering it, though.

-Bart

-- 
ubuntu-users mailing list
ubuntu-users at lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-users


       
---------------------------------
Looking for last minute shopping deals?  Find them fast with Yahoo! Search.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20080305/31b15962/attachment.html>