LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices

Reply
 
Search this Thread
Old 08-29-2004, 03:29 PM   #1
jhayden
LQ Newbie
 
Registered: Mar 2003
Location: Wichita, KS, USA
Distribution: Redhat-7.2,9 Slackware-9.1,10
Posts: 13

Rep: Reputation: 0
Recovering NTFS partition off repartitioned hard drive


Someone gave me their Maxtor 80GB hard drive to try to recover their files off of. It had an NTFS partition with Windoze EX-P. Apparently, some of the Windoze files got corrupted and wouldn't boot. He then reinstalled Windoze, reformatting the hard drive. I'm not sure he used the same partition scheme on it. He then gave it to me to try to recover his files from his previous Windoze installation. I put the hard drive in my Slackware box running a 2.6 kernel with NTFS support and proceeded to mount the NTFS partition. Looking over the partition, I concluded all of his files from his previous Windoze installation were gone, as only system files were on it. I then partitioned it as one EXT3 partition and fsck'ed it. It did find some errors. Someone told me that some of the data should still be recoverable from the original Windoze install. If this is true, could someone point in a direction as to recovering these files?

Thanks!
Josh
 
Old 08-29-2004, 08:44 PM   #2
J.W.
LQ Veteran
 
Registered: Mar 2003
Location: Milwaukee, WI
Distribution: Mint
Posts: 6,642

Rep: Reputation: 69
Just for the sake of illustration, if the files in question existed on Monday, but then the system became corrupted on Tuesday, and your friend reformatted the hard drive Wednesday, reinstalled XP on Thursday, and then he gave you the hard drive on Friday, my guess would be that without specialized tools, you are plain out of luck. I will emphasize that this is not my area of expertise, but I seriously doubt that a file on a corrupted system could survive both a reformat and a reinstall and then be recovered by "Joe Public", even if he was highly experienced.

There are data recovery services which can probably do the work for you, but it won't be cheap. I'm not trying to be negative but as I understand it, you need highly specialized tools, and need to disassemble the hard drive to do a very precise magnetic scan on the platter surface in order to recover any data, and even that's not guaranteed. Had your friend given you the drive sometime on Tuesday (using the same example) I'm pretty sure you easily could have recovered it - all you'd really need to do would be to mount the drive manually and retrieve the files. After the reformat and reinstall though, I would say that recovery would probably be out of reach to the general public. Anyone with better info - please post. -- J.W.
 
Old 08-30-2004, 09:03 AM   #3
jhayden
LQ Newbie
 
Registered: Mar 2003
Location: Wichita, KS, USA
Distribution: Redhat-7.2,9 Slackware-9.1,10
Posts: 13

Original Poster
Rep: Reputation: 0
Thanks for the reply. That's kind of what I was thinking. The guy that told me there may still be data from the original install said he has a friend that works for the government that has been able to retrieve data from 15 formats ago! Of course, he also works for the government. I was just wondering if software like this would be able to recover files from Monday of your illustration. My understanding is that when he installed XP on Thursday, it would only permanently delete Monday's files that were on the same physical part of the drive that the XP install was being put on. Meaning, only some of the files would be, theoretically, partially overwritten or permanently gone.

So, there's probably no software way to grab what's on the surface of the disk? I don't know anything about this kind of thing. Even if he would've given me the drive Wednesday, after deleting partitions, I may've been able to recover it then. I know I've deleted partitions and then created them again with the same parameters and the files are all still there.

Josh
 
Old 08-30-2004, 10:51 AM   #4
J.W.
LQ Veteran
 
Registered: Mar 2003
Location: Milwaukee, WI
Distribution: Mint
Posts: 6,642

Rep: Reputation: 69
Josh -- well I just don't know whether that software would work or not. Along those lines, Yes, if you start talking law enforcement and/or federal agencies, their have the maximum data recovery resources that are available. Personally I'm somewhat skeptical about claims that it would be possible to "always" recover old data (when you overwrite data, to a certain degree, due to the fact that the disk is magnetic, there will be some residual magnetic charge from the previous data, sort of like a double exposure photo, where the older image is faintly visible. At some point though, like maybe an 8 or 9 exposure photo, it seems hard to imagine that the original data could be conclusively recovered. Just my opinion, this is not a statement of fact).

Perhaps your friend should give the disk to his govt friend. As I said, there are data recovery services available, but realistically, the more times data has been overwritten, the less likely it will be for the general public to get it back. Good luck with it either way -- J.W.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Recovering data from repartitioned ntfs drive booyabazooka Linux - Software 2 09-20-2004 10:37 PM
recovering an ntfs drive with linux kinasz Linux - General 4 07-08-2004 07:37 AM
Recovering files from an NTFS partition? RadicalGrande Linux - General 4 03-17-2004 11:39 PM
Recovering Hard Drive files CycloLink Linux - Hardware 6 01-29-2004 07:59 PM
recovering a fat 32 hard drive kingswood76 Linux - General 13 07-26-2002 08:29 AM


All times are GMT -5. The time now is 02:44 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration