LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices

Reply
 
Search this Thread
Old 08-08-2007, 02:56 AM   #1
rizhun
Member
 
Registered: Jun 2005
Location: England
Distribution: Ubuntu, SLES, AIX
Posts: 268

Rep: Reputation: 47
Brother Nuke'd HD -- Need to Recover Data !!


Hi,

Yes, the subject gave it away. My brother has formatted the HD of my RedHat box.

I believe that formatting just marks blocks on the HD as 'empty', so I'm hoping there's a way to recover some of the data.

Can anyone recommend any software/reading to get this done?

Thanks.
 
Old 08-08-2007, 04:58 AM   #2
sadiqdm
Member
 
Registered: Nov 2003
Location: London, UK
Distribution: openSUSE, Ubuntu
Posts: 357

Rep: Reputation: 35
Get hold of the GParted Live CD here choose the 0.3.3.7 ISO version rather than the latest. The new Fluxbox based GUI doesn't have enough tools. Burn it to a CD and then use that to boot your box. GParted will allow you to check the HD and fix the partition table. If you can't fix it, but you can access the data, then you will need soemthing like an Ubuntu Live CD with network support, so you back up to another machine on the same network. I did that the other day to extract the data from a trashed NT4 work station before doing a re-install. Boot the machine with the live CD, get it onto the network, then mount the drive from a second PC and copy off the data.
 
Old 08-08-2007, 05:08 AM   #3
rizhun
Member
 
Registered: Jun 2005
Location: England
Distribution: Ubuntu, SLES, AIX
Posts: 268

Original Poster
Rep: Reputation: 47
Thanks, sadiqdm.
I'll give this a try after work!
 
Old 08-08-2007, 05:17 AM   #4
b0uncer
Guru
 
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Rep: Reputation: Disabled
Quote:
Boot the machine with the live CD, get it onto the network, then mount the drive from a second PC and copy off the data.
Just out of curiosity, if the disk was formatted, how would mounting it show the old data? In my opinion it will mount the new formatted filesystem, with nothing much visible inside, and not allow you to touch to the older content.
There are loads of rescue programs on the web, for both Windows and Linux (and for others too..but these two are the ones folks usually have), and some of them are even free of charge. Many are commercial and a lot of them have "free demo versions", but those demos usually have a limitation like they only recover 10 first found files, or even more commonly, show you what the program could recover, but won't do it before you buy the full version. I suggest you try one of those out. Not sure how effective they are, but if it's only formatted (and nothing is written on the disk after that -- do not mount it with write permissions, but read-only!) chances are good you'll get the things back.

If GParted (or alike) really could fix the table and bring back your data, I'd be both surprised and thankful. But this far I've always thought GPartEd (and alike) are merely "partition editors", not recovery software, so I would go after the recovery software myself. If the data is _really_ important, and not just warez, you may be willing to pay for a commercial recovery program (but in that case make sure it really is worth it). Or if it's really really really important, you might even want to take the disk to a recovery lab, though that will cost quite a lot of money..

Again, only mount the disk read-only, never read-write, to make sure the data doesn't get accidentally overwritten. You can use dd to make an exact image of the disk, just in case, but the image will be the size of the harddisk, so you'll need quite a lot of free HD space there. It works like this:
Code:
dd if=/dev/hda of=/home/username/hd_image
provided that your harddisk would be the primary IDE disk (hda) and you wanted the image file hd_image to be created under /home/username. You could then work on the copied image file, leaving the disk untouched, or at least have a "backup" in case the harddisk contents get wrecked. You may also use dd to put the image back to the disk (in that case just swap if= and of= arguments, so if is the image and of is the disk).
 
Old 08-08-2007, 05:19 AM   #5
rizhun
Member
 
Registered: Jun 2005
Location: England
Distribution: Ubuntu, SLES, AIX
Posts: 268

Original Poster
Rep: Reputation: 47
Didn't occur to me to ask before, but what's the command to try and fix the disk?
fsck?
 
Old 08-08-2007, 05:23 AM   #6
rizhun
Member
 
Registered: Jun 2005
Location: England
Distribution: Ubuntu, SLES, AIX
Posts: 268

Original Poster
Rep: Reputation: 47
Thanks for that b0uncer.

Any recommendations for a free recovery tool?

There seems to be a few on SourceForge, but nothing really stands out.

thanks.
 
Old 08-08-2007, 05:32 AM   #7
b0uncer
Guru
 
Registered: Aug 2003
Distribution: CentOS, OS X
Posts: 5,131

Rep: Reputation: Disabled
fsck is a tool somewhat similar to the Microsoft ScanDisk, but I wouldn't go for that right now. Maybe dd an image of the disk to another disk and try it there; I think it just fixes broken partition tables, and since you said your disk is formatted, it's new partition table is probably just fine and fsck won't do a thing -- not anything good, at least.

I haven't used recovery software myself too much, this far I've (luckily) encountered only one disk that went downhill and it was beyond the skills of any recovery software I tried. Wasn't important enough for me to try those recovery labs, so I just let it be. Most if not all of the recovery programs can scan the disk and show what is found, before actually trying to recover anything, so you may try several of them to see if one works better than others. Or you can do a little web search for ratings or reviews of the tools..

EDIT: in my case the disk was a 512MB flash disk, which suffered a power surge, after which it seemed to be detected as a 8MB media that no machine could mount. I used dd to make an image out of it and loaded that into a hex editor that could show some ASCII data inside, and found out that for some reason the filesystem on the disk -- which couldn't be even formatted or written to anymore -- was just repeating a small section from the beginning of the original partition up to about 8MB. So..it was dead.

Last edited by b0uncer; 08-08-2007 at 05:36 AM.
 
Old 08-08-2007, 05:40 AM   #8
jay73
Guru
 
Registered: Nov 2006
Location: Belgium
Distribution: Ubuntu 11.04, Debian testing
Posts: 5,019

Rep: Reputation: 130Reputation: 130
Testdisk and photorec.

Testdisk should be your first stop. It will scan the disk for lost partitions. If you're lucky, your brother only wiped out the partition table. That can usually be repaired within a matter of minutes, without copying out any data. The basic idea is that you simply infer the old partition table from the disk and have it rewritten to the start of the disk.

Photorec is indispensible when the situation is worse, i.e. when the disk was actually formatted. A Format will preserve most/all of your data but it overwrites their names so that they become invisible to the system. Photorec will scan the disk and try to recover as many of these anonymous data as possible. Make sure you have plenty of space to back up to: photorec is so thorough that it may also recover data that were deleted a long long time ago. It is not 100% failsafe, though. It does an excellent job recovering text files and images but it does not always perform well on multimedia files, especially the larger ones. There is a real risk that some music/movie files will either be beyond repair or cut op and reconstituted in the wrong way or simply ran together. Just bear in mind that you files will have lost their names and that you will have a lot of sorting and renaming to do.
 
Old 08-11-2007, 06:05 PM   #9
choogendyk
Senior Member
 
Registered: Aug 2007
Location: Massachusetts, USA
Distribution: Solaris 9 & 10, Mac OS X, Ubuntu Server
Posts: 1,189

Rep: Reputation: 105Reputation: 105
have you tried

$ format brother

Sorry, ;-) , I know it doesn't help with recovering the drive. I just so wish I could have done that when I was a kid. Then again, that may have nothing to do with your sibling relationship.

On the serious side, the trick with dd and a hex editor is pretty cool. I'd never heard of that before. Certainly don't mess with anything like fsck until you've used a tool designed to look for and recover lost content. Using the wrong tool first can just make things worse. Jay73 sounds right on.
 
Old 08-11-2007, 07:18 PM   #10
teckk
Senior Member
 
Registered: Oct 2004
Distribution: FreeBSD Arch
Posts: 1,751

Rep: Reputation: 188Reputation: 188
This may help. It has autopsy and sleuth kit.
http://www.efense.com/helix/
 
  


Reply

Tags
data recovery, redhat


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
recover data sse007 Slackware 3 07-10-2006 09:17 PM
Software to acess and recover data on Fat32 data NeoSpawn Linux - Software 2 09-04-2005 11:37 AM
How to recover your data. raxxal Linux - Software 2 07-05-2005 11:59 AM
data recover please ..! bruse Mandriva 7 04-15-2005 01:12 AM
Help me to recover data after a dd balfred Linux - General 6 12-09-2002 04:35 PM


All times are GMT -5. The time now is 11:14 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration