LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices



Reply
 
Search this Thread
Old 01-19-2006, 09:48 AM   #1
nickleus
Member
 
Registered: Nov 2004
Location: Noreg
Distribution: ubuntu
Posts: 107

Rep: Reputation: 15
how do i salvage/recover erased/unerased data on my hard drive?


how do i salvage unerased data on my hard drive?
i have a 120GB hard drive connected to my linux machine through a usb
2.0 because i'm trying to figure out if there is anything salvagable on
it. i think i accidentally erased some stuff on there (repartitioned
a portion of it on accident?) in windows and i
hope i can save what is left. here is some output that might give a good
status of things:
-----------------------------------
Code:
[root@localhost nickleus]# /sbin/fdisk -l

Disk /dev/hda: 60.0 GB, 60011642880 bytes
255 heads, 63 sectors/track, 7296 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          13      104391   83  Linux
/dev/hda2              14        7296    58500697+  8e  Linux LVM

Disk /dev/sda: 120.0 GB, 120034123776 bytes
191 heads, 63 sectors/track, 19483 cylinders
Units = cylinders of 12033 * 512 = 6160896 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1        5490    33027624    4  FAT16 <32M

Disk /dev/sda1: 33.8 GB, 33820286976 bytes
191 heads, 63 sectors/track, 5489 cylinders
Units = cylinders of 12033 * 512 = 6160896 bytes

     Device Boot      Start         End      Blocks   Id  System
/dev/sda1p1   *           1        5490    33027624    4  FAT16 <32M
---------------------------------------------------

i think the 33.8GB is the portion i somehow repartioned/erased in winxp,
so i think that is all erased, but how do i access/mount the rest?

when i run:
Code:
mount -t vfat /dev/sda /mnt /usbhdsda
i get the following error:
Code:
mount: wrong fs type, bad option, bad superblock on /dev/sda,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
i've tried also mounting it as ntfs (have installed the rpm) and msdos
too and get the same message. and what does sda1p1 mean?

here's my output from dmesg:
Code:
NTFS-fs error (device sda1): read_ntfs_boot_sector(): Primary boot
sector is invalid.
NTFS-fs error (device sda1): read_ntfs_boot_sector(): Mount option
errors=recover not used. Aborting without trying to recover.
NTFS-fs error (device sda1): ntfs_fill_super(): Not an NTFS volume.
FAT: invalid media value (0xb9)
VFS: Can't find a valid FAT filesystem on dev sda.
FAT: invalid media value (0xb9)
VFS: Can't find a valid FAT filesystem on dev sda1.
FAT: invalid media value (0xb9)
VFS: Can't find a valid FAT filesystem on dev sda1.
Any help will be greatly appreciated. the info i might have lost is old family pictures and videos and precious stuff like that =(

Nick

Last edited by nickleus; 01-19-2006 at 09:59 AM.
 
Old 01-19-2006, 10:05 AM   #2
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729
No backup?----sigh...

"Erasing" files (and re-partitioning) does not wipe out the actual bit patterns---it simply deletes the pointers. You may need to bring in a data recovery specialist. Since you did not have a hardware failure, the odds are on your side

There are tools for scanning the raw device and--if you have the patience--you can attempt your own recovery.
 
Old 01-19-2006, 10:12 AM   #3
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729
If you want to simply poke around and see what's there, start with dd

dd if=/dev/sda bs=512 count=N|hexdump -C >filename

This puts N sectors of data in hex format into the file "filename". Look at man dd for other options---eg to start at an arbitrary sector instead of 0.

If you know what you are looking for, you can use grep on the saved file.

PROCEED WITH CAUTION---Something like dd will destroy your data very efficiently and with no warning
 
Old 01-19-2006, 10:12 AM   #4
nickleus
Member
 
Registered: Nov 2004
Location: Noreg
Distribution: ubuntu
Posts: 107

Original Poster
Rep: Reputation: 15
linux tool for data recovery

any suggestions of linux tools for recovering data? i am a do-it-yourself type guy so i'll give it a whirl if somebody justs points me in the right direction.. thanks for your reply
 
Old 01-19-2006, 10:14 AM   #5
nickleus
Member
 
Registered: Nov 2004
Location: Noreg
Distribution: ubuntu
Posts: 107

Original Poster
Rep: Reputation: 15
pixellany, but that code bit you suggested is safe to run then?
 
Old 01-19-2006, 10:22 AM   #6
bobmclaren
LQ Newbie
 
Registered: Nov 2005
Location: Senoia, GA
Distribution: Latest Fedora
Posts: 14

Rep: Reputation: 0
Oooh oooh! I think I might be able to help with this one.
First of all, I noticed that you attempted to mount /dev/sda, that's no good, you need to mount a partition on /dev/sda, like /dev/sda1. However, the output from dmesg makes me think that's not going to be fruitful anyway.

So, we are left with data recovery. So here's the concept, Knoppix (and other distros) have tools that will allow you to do a "raw dump" bit-for-bit of you entire partition, or parts of it and then scan the contents for old files that have lost their pointers (been deleted). I had to do it once to help the CFO retrieve a valuable email that was accidentally deleted from a Linux server. Worked awesome! But took all day.

I can't walk you through it step-for-step, but here is what you should look in to:
gpart- Finds lost partitions (not sure if this applies to you)
unrm- Scans "free" space on your HD for files that have been deleted
lazarus- Scans the results of unrm and splits the data up into separate files (slooow, but effective)

A google search on those tools should get you what you need. May fortune shine upon you.
 
Old 01-19-2006, 10:35 AM   #7
nickleus
Member
 
Registered: Nov 2004
Location: Noreg
Distribution: ubuntu
Posts: 107

Original Poster
Rep: Reputation: 15
bobmclaren, thanks a lot, i'll look up those things and give it a try =)
 
Old 01-19-2006, 10:57 AM   #8
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729
Quote:
Originally Posted by nickleus
pixellany, but that code bit you suggested is safe to run then?
If you always run dd without the "of" option, then it cannot write to the raw device---ie it will write to the screen or to a named file.

Where dd can GET you is in doing raw device reads and write and getting the "of" and "if" mixed up.
 
Old 01-19-2006, 10:59 AM   #9
nickleus
Member
 
Registered: Nov 2004
Location: Noreg
Distribution: ubuntu
Posts: 107

Original Poster
Rep: Reputation: 15
pixellany, thanks again for your quick reply i also just found a program called file scavenger for windows and am running it now. it seems to work great!

Last edited by nickleus; 01-19-2006 at 06:51 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to recover data from hard disk dongyan_liu Linux - Newbie 1 12-01-2005 06:56 PM
How to salvage data from crippled LVM Kokuyo Linux - General 4 11-18-2005 01:04 PM
(hard one) cant mount ext2(or swap) anymore - recover data pawn-o-matic Linux - Hardware 3 03-24-2005 03:17 PM
Salvage Crashed Hard Drive? lmedwards Linux - Hardware 8 11-24-2004 04:03 PM
recover data from physically damaged drive kc8tbe Linux - General 11 05-29-2004 02:58 PM


All times are GMT -5. The time now is 06:57 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration