Re: Undo of mkfs - urgent

From: Brian Stults (bstults_at_crim.ufl.edu)
Date: 08/26/03

  • Next message: Kirk Strauser: "Re: COBOL compiler"
    Date: Tue, 26 Aug 2003 08:50:59 -0400
    To: debian-user@lists.debian.org
    
    

    Manfred Heubach wrote:
    > Hello,
    >
    > I've accidently used mkfs.ext3 on the wrong harddisk (used hdb3 instead of hda3). Is there any way to recover the files on this partition? There is no backup copy of this partition.
    > If it is not possible to recover the files or filesystemstructure maybe it's possible to extract some files from the raw device. Except of running mkfs no data has been written to that disk.
    > I had 5 zipped tar files (about 800MB each) on this partition. Maybe it's possible to recover at least these files. If tar files all start and end with the same sequence of bytes there should be a chance of finding them on the 20GB HDD. Does anyone no how to identify tarfiles in raw partition data?
    >

    I would keep looking for a better solution than what I mention below,
    but if all else fails...

    If nothing has been written to that disk since, you may be able to
    recover some of the files. I can recommend two methods.

    If there are specific types of files you want, you can use "foremost"
    (see http://www.samag.com/documents/s=8859/sam0309a/sam0309a.htm). It
    allows you to specify a unique header and footer for a file type (e.g.
    ffd8 and ffd9 for jpeg). It will then comb through your partition
    saving evertyhing between the headers and footers it finds. It worked
    nearly perfectly for me to recover some digital photos. I was able to
    cover 149 of 150. The 150th was recovered, but had a black band near
    the bottom. I suspect that some data was written over it. It is also
    surprisingly fast.

    The other tool, which is more popular but I had less success with, is
    the Coroner's Toolkit (TCT). It is available as a deb (i.e. apt-get
    install tct). You can use "unrm" to extract all allocated blocks to
    another partition. Then you can use lazarus to go through all that
    output and try to identify and save files. You need a lot of space for
    this. I couldn't use unrm because it wouldn't read my version of
    reiserfs, but you can also use dd to pull the data. The disadvantage is
    that dd pulls all blocks - both allocated and unallocated. That takes
    even more space.

    Good luck!

    -- 
    Brian J. Stults
    Assistant Professor
    Center for Studies in Criminology and Law
    University of Florida
    phone: (352) 392-1025 x207    fax: (352) 392-5065
    -- 
    To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
    

  • Next message: Kirk Strauser: "Re: COBOL compiler"