LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 04-03-2008, 10:01 PM   #1
g0kuss4
LQ Newbie
 
Registered: Aug 2003
Location: Miami, Florida, USA
Distribution: Gentoo 1.4
Posts: 5

Rep: Reputation: 0
Unhappy Recovering files from an ext3 partition after forgetting to umount before removal


I was backed up my system to a 500gb usb external drive and yanked out the usb cable without thinking (or checking if the files were properly transfered for that matter). After formatting and installing FC7, I plug in the drive to find it empty (was empty prior to the backup). I df the drive and it tells me the drive has a total of 460gb, 199mb used, 435gb available. The files I attempted to back up (~25gb) are there, somewhere, I think (hope).

Is there a way to recover at least part of the data? I've had a horrible day and this was the perfect end.
 
Old 04-03-2008, 11:26 PM   #2
Junior Hacker
Senior Member
 
Registered: Jan 2005
Location: North America
Distribution: Debian testing Mandriva Ubuntu
Posts: 2,687

Rep: Reputation: 61
First thing to do is to cease using both the computer or the external drive, because your data can be recovered from possibly both. Using a data carver that searches for file signatures in every sector of a drive/partition to recover files not yet overwritten with new data regardless of new partitioning and or re-formatting. The only time a sector is cleared is when you use a zero fill utility or a random write pattern over every sector, the data that used to be there is still there until you overwrite it by downloading e-mail, etc..
When you install a new operating system in a new partition where the new partition starts in the same place as the last that contained an old OS, it will generally be installed in the same area of the drive as the old OS reducing the risk of overwriting personal data stored in another "region" of the partition.
Boot with a live CD containing testdisk package and open up a full screen terminal and issue command: photorec to recover many of the most common file formats from either or both drives. Just make sure to have another drive to write the contents of photorec's findings, which can be nearly as large as the partition itself in size on an older drive.
Any forensics CD has many useful applications to assist in stubborn situations, like the Helix CD base on Knoppix.
 
Old 04-03-2008, 11:32 PM   #3
Junior Hacker
Senior Member
 
Registered: Jan 2005
Location: North America
Distribution: Debian testing Mandriva Ubuntu
Posts: 2,687

Rep: Reputation: 61
BTW:
Forensics CD's generally mount hard drives in read only mode, you must unmount them and re-mount in read/write mode to write to a hard drive. Some reading of the "Helix for beginners" documentation may also be helpful.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Recovering a deleted and formatted over ext3 partition? Soniku Linux - General 4 04-02-2007 07:12 PM
Recovering files from ext3 overwritten with reiserfs ReefShark Linux - Software 5 09-22-2005 07:06 AM
Recovering A Destroyed Ext3 Rh6.2 Partition sam-zee Linux - Hardware 0 01-30-2005 05:46 PM
Frontend for recovering deleted files from ext3 filesystem jayakrishnan Linux - General 3 12-16-2004 02:21 PM
Recovering Data From A Freshly Reformatted Ext3 Partition johnleemk Linux - Hardware 1 02-04-2004 01:48 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 04:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration