LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 03-25-2007, 02:18 AM   #1
Soniku
LQ Newbie
 
Registered: Mar 2006
Posts: 4

Rep: Reputation: 0
Red face Recovering a deleted and formatted over ext3 partition?


Ok, I don't want to sound like a total idiot, but at the risk of sounding like said total idiot, I'm going to skip the long-winded story and explain my current situation:

I have a 320GB hard drive of which I was using as a file drive on a Slackware box. It only had one ext3 partition that encompassed the entire drive and was filled to the brim with files.

Let's just say that it somehow got formatted over with an XP NTFS partition (using the slow format option) and as soon as it booted into XP, it was promptly shutdown and hasn't been touched since.

Obviously my question is, is there any way to recover the deleted data? I know that not all of it will be recoverable, but most of it should be, one way or another.

I tried using Hiren's BootCD 8.8, but I couldn't find any useful tools on there (the only one that seemed like it would do the job, isn't capable of recovering Linux-based partitions). I downloaded Knoppix-STD and ran some sort of analysis with testdisk, but it didn't seem to find anything... Tomorrow I'll have to check for options that I could've possibly missed...

It's not extremely important that I recover everything... I can probably get back most of it anyway, but I'd like to know how to do this for the future, in case the problem arises again in a more serious manner.

All help is appreciated, thanks.
 
Old 03-25-2007, 03:15 AM   #2
Junior Hacker
Senior Member
 
Registered: Jan 2005
Location: North America
Distribution: Debian testing Mandriva Ubuntu
Posts: 2,687

Rep: Reputation: 59
Most peeps will tell you once you re-format, it's gone.

That is false, but not all types of data are easy to recover. In the thread link below I provide other useful links, you'll run into another thread where a person called Soren or something, recovered most of his files using an older version of Foremost, he also provided a link to download it, that is the link I used to get it. It worked better than Foremost 1.4 and scalpel that only produced thumbnails of the photos I was after. Well...foremost 1.4 pulled the full size ones also after I found what commands to use with it in x86_64 systems. Anyway, check all the links, best to read up a little. The Helix live CD http://www.e-fense.com/helix/ also has foremost, not sure what version. I've been playing with it but have been un-successful at mounting a "suspect" drive properly or something, it would get 300 or 400 .jpg photos and give up with an error, mount problems I suspect, got to get back at her tomorrow and master that CD.

http://www.linuxquestions.org/questi...d.php?t=536461
 
Old 03-28-2007, 02:55 AM   #3
Soniku
LQ Newbie
 
Registered: Mar 2006
Posts: 4

Original Poster
Rep: Reputation: 0
Thanks for the reply. I tried foremost, and nothing really seemed to happen, maybe I'm not using it correctly? I'm not really sure... I'll have to mess with it again.

I also tried testdisk, and photorec, testdisk couldn't find anything and photorec yielded some crazy results (half gig jpg files)... I basically had the same results with everything else.

I'm about to try FTK since my friend claims that that works and we did learn about it in one of my classes, although I really don't think it'll do anything either.
 
Old 03-28-2007, 03:06 AM   #4
Junior Hacker
Senior Member
 
Registered: Jan 2005
Location: North America
Distribution: Debian testing Mandriva Ubuntu
Posts: 2,687

Rep: Reputation: 59
I've tried a few, it took a while to get foremost to work, got lots of errors to the point I just about quit. I just finished running foremost from a Live CD, and going through the results right now. Nothing like the results I got using foremost-1.1 in a 32bit system though. But because I'm into the forensics thing, I keep playin' with all of them. So far, the foremost-1.1 seems to be king of the hill for .jpg images. When I tried retrieving .doc with it I got an infinite loop of the same .tci or whatever they were, (turbo cad images), that weren't even .doc format.
But you must have the same problem with foremost I had when I first tried it, not using the right command format.
Persistence pays.
 
Old 04-02-2007, 07:12 PM   #5
Junior Hacker
Senior Member
 
Registered: Jan 2005
Location: North America
Distribution: Debian testing Mandriva Ubuntu
Posts: 2,687

Rep: Reputation: 59
Sorry, was telling you about photorec, but noticed you tried it already. It did an superb job for me.

Last edited by Junior Hacker; 04-02-2007 at 07:15 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Recover formatted ext3 partition files mazzo Linux - General 9 07-02-2010 08:36 AM
Recovering a deleted file on ext3... almost there! abegetchell Linux - Software 12 10-15-2009 10:10 AM
Recovering formatted partition TowiKromo Linux - Laptop and Netbook 1 11-10-2006 03:21 PM
Accidentally formatted a NTFS partition with ext3 kamran_pro Linux - Software 1 10-29-2006 02:31 AM
Frontend for recovering deleted files from ext3 filesystem jayakrishnan Linux - General 3 12-16-2004 02:21 PM


All times are GMT -5. The time now is 11:31 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration