Re: Undo of mkfs - urgent

• Previous message: Mark Roach: "Re: COBOL compiler"
• In reply to: Manfred Heubach: "Undo of mkfs - urgent"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Date: Tue, 26 Aug 2003 08:50:59 -0400
To: debian-user@lists.debian.org

Manfred Heubach wrote:
> Hello,
>
> I've accidently used mkfs.ext3 on the wrong harddisk (used hdb3 instead of hda3). Is there any way to recover the files on this partition? There is no backup copy of this partition.
> If it is not possible to recover the files or filesystemstructure maybe it's possible to extract some files from the raw device. Except of running mkfs no data has been written to that disk.
> I had 5 zipped tar files (about 800MB each) on this partition. Maybe it's possible to recover at least these files. If tar files all start and end with the same sequence of bytes there should be a chance of finding them on the 20GB HDD. Does anyone no how to identify tarfiles in raw partition data?
>

I would keep looking for a better solution than what I mention below,
but if all else fails...

If nothing has been written to that disk since, you may be able to
recover some of the files. I can recommend two methods.

If there are specific types of files you want, you can use "foremost"
(see http://www.samag.com/documents/s=8859/sam0309a/sam0309a.htm). It
allows you to specify a unique header and footer for a file type (e.g.
ffd8 and ffd9 for jpeg). It will then comb through your partition
saving evertyhing between the headers and footers it finds. It worked
nearly perfectly for me to recover some digital photos. I was able to
cover 149 of 150. The 150th was recovered, but had a black band near
the bottom. I suspect that some data was written over it. It is also
surprisingly fast.

The other tool, which is more popular but I had less success with, is
the Coroner's Toolkit (TCT). It is available as a deb (i.e. apt-get
install tct). You can use "unrm" to extract all allocated blocks to
another partition. Then you can use lazarus to go through all that
output and try to identify and save files. You need a lot of space for
this. I couldn't use unrm because it wouldn't read my version of
reiserfs, but you can also use dd to pull the data. The disadvantage is
that dd pulls all blocks - both allocated and unallocated. That takes
even more space.

Good luck!

-- 
Brian J. Stults
Assistant Professor
Center for Studies in Criminology and Law
University of Florida
phone: (352) 392-1025 x207    fax: (352) 392-5065
-- 
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

• Previous message: Mark Roach: "Re: COBOL compiler"
• In reply to: Manfred Heubach: "Undo of mkfs - urgent"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]