[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: recovery recommendations



Hello m.p.

On Friday 21 January 2011 19:36:41 m.p. wrote:
> Recently a 640GB external enclosure was PEBKAC'd with the following
> command:

A short time ago I overwrote the first 12GB of my single-disk 1TB system. Thise 
12GB luckily contained only OS files I was about to replace anyway (still gotta 
write that up as solved; see the archives for "Overwritten beginning of ext3 
filesystem. Recovery?" on 27dec2010). I got all my important user data back in 
one piece.

Depending on usage patterns and the kind of data you had on that disk, I think 
your chances are pretty good to get most of it back.

> So. I am *convinced* that my 550gb of data is recoverable. It seems that
> [obviously] the first 185mb is gone - whatever files those were.

In my case, I overwrote an ext3 partition's first few GB with a valid ext3 FS 
of identical size but different content. fsck then found lots of errors (in the 
"overlaying" FS) due to it being incomplete. The problems were so bad that it 
never actually got to recovering the good ("underlaying") data.

What did the trick for me was to zero out the offending stuff. In your case that 
would be sth. like:

* Keep a copy of your "unrecovered" disk image! You don't want to touch the
   original disk at all, so be prepared for making mistakes
* dd if=/dev/zero of=PARTIMAGE count=ISOSIZE
   where ISOSIZE is the ISO image's size in bytes
* Extract the partition image like Alex Bligh wrote and work with that
* e2fsck -f -y /dev/sdx1  (perhaps -b and -C0 as well)
   e2fsck will probably ask you to be run again (might want do that anyway to
   make sure)

You'll then find the remainder of your data in lost+found/, even most directory 
hierarchies will be intact. Some pretty much random(!) data blocks from 
seemingly anywhere(!) on disk will be zeroed out, but at least those will be 
easily recognizable. The exact outcome depends on what data you had on there, 
as well as usage scenario and history.

It's imperative that you check every file of the results - any data block might 
be missing, any subdirectory might be missing. If you lost a directory entry, 
chances are high that it's contents will show up directly (and namelessly) in 
lost+found/.

Hope that helps. If you find the time, please keep me posted about your 
results.

-- 
With best regards,
Florian Weber


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]