Data Recovery from former NTFS partition
 

Earlier tonight I was installing Gentoo on on my second hard drive and I was tottling along just fine...and then when I went to make the boot partition using mke2fs i accidentally typed in /dev/hda1 instead of /dev/hdb1

/dev/hda1 was my Windows XP (Home Edition) partition and it had lots of valuable data I didn't have on backup. Is there any (preferrably free) way to recover the data? The partiton is now formatted with ext2 and when I opened it up with Knoppix, it said it has an (empty) folder on it called "lost+found"

Any help would be GREATLY appreciated

Thanks in advance

Re: Data Recovery from former NTFS partition
 

Sh*t :(:(:(:(:( ...your partition looks like it's snafued as the chance of recovering an snafued partition is pretty slim.

The /lost+found folder is where lost files and directories on an ext2 partition go if the ext2 partition gets corrupted - like FILExxxx.CHK from DOS's Chkdsk. Filenames and dirnames stored here look like 2859_3928, 1234_5, 7_7656, 7_7, etc. This has nothing to do with recoving data from overwritten partitions.

Ermmm....you could try the following (I haven't tried this method), assuming you did not put any files on the partition, activated your swap partition, used 2 or more partitions on that disk, or checked for bad blocks.:

In a terminal or an xterm, log yourself in (or su yourself in) as root, and type:

# fdisk /dev/hda

Command (m for help): p

Here, record the output on paper (this is your existing partition layout.)
We need to change the partition ID from Linux to NTFS on /dev/hda1.

Command (m for help): t
Partition number:
1
Enter type (type L to list codes): <------ Here you put the partition ID for NTFS.

Partition 1 changed its type to NTFS/HPFS (or some other message)

Command (m for help): w (to exit fdisk)

# mount -t ntfs /dev/hda1 /mnt/hd

(If you get an error ending "too many mounted filesystems" type "modprobe ntfs" if it's supported and try the mount command again)

If this doesn't work, it looks like your data may be _very_ difficult to fix. :(:(:(

You may have to resort to professional data recovery solutions or get a file-system hacker to attempt it.

Well, thank god, problem solved.

None of the ideas suggested above worked for me but I was able to use chkdsk on BartPE (dont know the URL at the moment, search google for PE Builder). In case others need this, here is the procedure I followed.

Ran the chkdsk utility with the /r switch.

Waited.
DONE!

Thats all. If I were to do it again, I would suggest running it twice cause I still have a few bad blocks etc. But other wise, it works like a charm.

BARTpe is nice, but I'm wondering if you already had one of those BartPE Disks made back when your Windows partition was still healthy.

If there's a way to just download the files from

http://www.nu2.nu/pebuilder/

burn them,

boot them

and viola I have access to the Window XP NTFS files that weren't there,

that would make me happy.

As is the case for me, I don't one of those BartPE disks from before the drive became corrupted.

PEbuilder.exe seems worthless if you can't remember the directories from the old drive.