Recovering files from an ext3 partition after forgetting to umount before removal
Linux - GeneralThis Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Recovering files from an ext3 partition after forgetting to umount before removal
I was backed up my system to a 500gb usb external drive and yanked out the usb cable without thinking (or checking if the files were properly transfered for that matter). After formatting and installing FC7, I plug in the drive to find it empty (was empty prior to the backup). I df the drive and it tells me the drive has a total of 460gb, 199mb used, 435gb available. The files I attempted to back up (~25gb) are there, somewhere, I think (hope).
Is there a way to recover at least part of the data? I've had a horrible day and this was the perfect end.
First thing to do is to cease using both the computer or the external drive, because your data can be recovered from possibly both. Using a data carver that searches for file signatures in every sector of a drive/partition to recover files not yet overwritten with new data regardless of new partitioning and or re-formatting. The only time a sector is cleared is when you use a zero fill utility or a random write pattern over every sector, the data that used to be there is still there until you overwrite it by downloading e-mail, etc..
When you install a new operating system in a new partition where the new partition starts in the same place as the last that contained an old OS, it will generally be installed in the same area of the drive as the old OS reducing the risk of overwriting personal data stored in another "region" of the partition.
Boot with a live CD containing testdisk package and open up a full screen terminal and issue command: photorec to recover many of the most common file formats from either or both drives. Just make sure to have another drive to write the contents of photorec's findings, which can be nearly as large as the partition itself in size on an older drive.
Any forensics CD has many useful applications to assist in stubborn situations, like the Helix CD base on Knoppix.
BTW:
Forensics CD's generally mount hard drives in read only mode, you must unmount them and re-mount in read/write mode to write to a hard drive. Some reading of the "Helix for beginners" documentation may also be helpful.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.