Re: Undo of mkfs - urgent
From: Brian Stults (bstults_at_crim.ufl.edu)
Date: Tue, 26 Aug 2003 08:50:59 -0400 To: email@example.com
Manfred Heubach wrote:
> I've accidently used mkfs.ext3 on the wrong harddisk (used hdb3 instead of hda3). Is there any way to recover the files on this partition? There is no backup copy of this partition.
> If it is not possible to recover the files or filesystemstructure maybe it's possible to extract some files from the raw device. Except of running mkfs no data has been written to that disk.
> I had 5 zipped tar files (about 800MB each) on this partition. Maybe it's possible to recover at least these files. If tar files all start and end with the same sequence of bytes there should be a chance of finding them on the 20GB HDD. Does anyone no how to identify tarfiles in raw partition data?
I would keep looking for a better solution than what I mention below,
but if all else fails...
If nothing has been written to that disk since, you may be able to
recover some of the files. I can recommend two methods.
If there are specific types of files you want, you can use "foremost"
(see http://www.samag.com/documents/s=8859/sam0309a/sam0309a.htm). It
allows you to specify a unique header and footer for a file type (e.g.
ffd8 and ffd9 for jpeg). It will then comb through your partition
saving evertyhing between the headers and footers it finds. It worked
nearly perfectly for me to recover some digital photos. I was able to
cover 149 of 150. The 150th was recovered, but had a black band near
the bottom. I suspect that some data was written over it. It is also
The other tool, which is more popular but I had less success with, is
the Coroner's Toolkit (TCT). It is available as a deb (i.e. apt-get
install tct). You can use "unrm" to extract all allocated blocks to
another partition. Then you can use lazarus to go through all that
output and try to identify and save files. You need a lot of space for
this. I couldn't use unrm because it wouldn't read my version of
reiserfs, but you can also use dd to pull the data. The disadvantage is
that dd pulls all blocks - both allocated and unallocated. That takes
even more space.
-- Brian J. Stults Assistant Professor Center for Studies in Criminology and Law University of Florida phone: (352) 392-1025 x207 fax: (352) 392-5065 -- To UNSUBSCRIBE, email to firstname.lastname@example.org with a subject of "unsubscribe". Trouble? Contact email@example.com