how do i salvage/recover unerased data on my hard drive?

nickleus · 01-19-2006, 08:48 AM

how do i salvage unerased data on my hard drive?
i have a 120GB hard drive connected to my linux machine through a usb
2.0 because i'm trying to figure out if there is anything salvagable on
it. i think i accidentally erased some stuff on there (repartitioned
a portion of it on accident?) in windows and i
hope i can save what is left. here is some output that might give a good
status of things:
-----------------------------------

Code:

[root@localhost nickleus]# /sbin/fdisk -l

Disk /dev/hda: 60.0 GB, 60011642880 bytes
255 heads, 63 sectors/track, 7296 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/hda1   *           1          13      104391   83  Linux
/dev/hda2              14        7296    58500697+  8e  Linux LVM

Disk /dev/sda: 120.0 GB, 120034123776 bytes
191 heads, 63 sectors/track, 19483 cylinders
Units = cylinders of 12033 * 512 = 6160896 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1        5490    33027624    4  FAT16 <32M

Disk /dev/sda1: 33.8 GB, 33820286976 bytes
191 heads, 63 sectors/track, 5489 cylinders
Units = cylinders of 12033 * 512 = 6160896 bytes

     Device Boot      Start         End      Blocks   Id  System
/dev/sda1p1   *           1        5490    33027624    4  FAT16 <32M

---------------------------------------------------

i think the 33.8GB is the portion i somehow repartioned/erased in winxp,
so i think that is all erased, but how do i access/mount the rest?

when i run:

Code:

mount -t vfat /dev/sda /mnt /usbhdsda

i get the following error:

Code:

mount: wrong fs type, bad option, bad superblock on /dev/sda,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

i've tried also mounting it as ntfs (have installed the rpm) and msdos
too and get the same message. and what does sda1p1 mean?

here's my output from dmesg:

Code:

NTFS-fs error (device sda1): read_ntfs_boot_sector(): Primary boot
sector is invalid.
NTFS-fs error (device sda1): read_ntfs_boot_sector(): Mount option
errors=recover not used. Aborting without trying to recover.
NTFS-fs error (device sda1): ntfs_fill_super(): Not an NTFS volume.
FAT: invalid media value (0xb9)
VFS: Can't find a valid FAT filesystem on dev sda.
FAT: invalid media value (0xb9)
VFS: Can't find a valid FAT filesystem on dev sda1.
FAT: invalid media value (0xb9)
VFS: Can't find a valid FAT filesystem on dev sda1.

Any help will be greatly appreciated. the info i might have lost is old family pictures and videos and precious stuff like that =(

Nick

pixellany · 01-19-2006, 09:05 AM

No backup?----sigh...

"Erasing" files (and re-partitioning) does not wipe out the actual bit patterns---it simply deletes the pointers. You may need to bring in a data recovery specialist. Since you did not have a hardware failure, the odds are on your side

There are tools for scanning the raw device and--if you have the patience--you can attempt your own recovery.

pixellany · 01-19-2006, 09:12 AM

If you want to simply poke around and see what's there, start with dd

dd if=/dev/sda bs=512 count=N|hexdump -C >filename

This puts N sectors of data in hex format into the file "filename". Look at man dd for other options---eg to start at an arbitrary sector instead of 0.

If you know what you are looking for, you can use grep on the saved file.

PROCEED WITH CAUTION---Something like dd will destroy your data very efficiently and with no warning

nickleus · 01-19-2006, 09:12 AM

any suggestions of linux tools for recovering data? i am a do-it-yourself type guy so i'll give it a whirl if somebody justs points me in the right direction.. thanks for your reply

nickleus · 01-19-2006, 09:14 AM

pixellany, but that code bit you suggested is safe to run then?

bobmclaren · 01-19-2006, 09:22 AM

Oooh oooh! I think I might be able to help with this one.
First of all, I noticed that you attempted to mount /dev/sda, that's no good, you need to mount a partition on /dev/sda, like /dev/sda1. However, the output from dmesg makes me think that's not going to be fruitful anyway.

So, we are left with data recovery. So here's the concept, Knoppix (and other distros) have tools that will allow you to do a "raw dump" bit-for-bit of you entire partition, or parts of it and then scan the contents for old files that have lost their pointers (been deleted). I had to do it once to help the CFO retrieve a valuable email that was accidentally deleted from a Linux server. Worked awesome! But took all day.

I can't walk you through it step-for-step, but here is what you should look in to:
gpart- Finds lost partitions (not sure if this applies to you)
unrm- Scans "free" space on your HD for files that have been deleted
lazarus- Scans the results of unrm and splits the data up into separate files (slooow, but effective)

A google search on those tools should get you what you need. May fortune shine upon you.

nickleus · 01-19-2006, 09:35 AM

bobmclaren, thanks a lot, i'll look up those things and give it a try =)

pixellany · 01-19-2006, 09:57 AM

Quote:

Originally Posted by nickleus

pixellany, but that code bit you suggested is safe to run then?

If you always run dd without the "of" option, then it cannot write to the raw device---ie it will write to the screen or to a named file.

Where dd can GET you is in doing raw device reads and write and getting the "of" and "if" mixed up.

nickleus · 01-19-2006, 09:59 AM

pixellany, thanks again for your quick reply

i also just found a program called file scavenger for windows and am running it now. it seems to work great!