LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 07-13-2009, 02:03 PM   #1
Jerblue
LQ Newbie
 
Registered: Jul 2009
Location: San Diego, CA
Distribution: Fedora
Posts: 6

Rep: Reputation: 0
Data recovery after formatting ext3 partition


First off, thank you to those that read and respond to my post. Second, I apologize in advance. I am fairly new to Linux, and even newer to the forums, so I apologize now, because I know that I will unintentionally do something that violates Linux and/or Forum etiquette. Here is my debacle:

1. When installing Fedora 11, for the second time, my installation hung when entering my root password. Being the impatient person I am, I hit enter a couple times as I was not sure what was happening. When the installer finally caught up, it was already preparing the wrong disk for the install. Immediately, I powered off and restarted the install with the only the correct hard disk connected.

2. After installing, I see one 698GB chunk of unallocated data on the disk that was wiped. No valid ext3 partitions.

3. In an attempt to recover the data I do the following:

3a. Using testdisk, the original ext3 partition is found, but cannot list the files. No other functions of testdisk produced any results, so (don't ask me why) I wrote the partition table that it did find.

3b. Going back to testdisk, I was able to now find the superblocks.

3c. I used one of the 10 or so entries listed and I ran the following: "fsck.ext3 -b 32768 -B 4069 /dev/sdb1"

4. This managed to repair some of the partition. I was able to now find ~80GB of data in the lost+found folder on the disk.

I made the mistake of running away with the information that I found while googling without really understanding what I was doing. So I'm not entirely sure if I was doing the right thing to begin with and why I only recouped 80 gigs of data. I'm looking to find ~700GB of data that I lost track of.

Can anyone point me in the direction of that data?!

Thank you so much.

Justin.
 
Old 07-13-2009, 02:13 PM   #2
business_kid
Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware & Android
Posts: 6,390

Rep: Reputation: 557Reputation: 557Reputation: 557Reputation: 557Reputation: 557Reputation: 557
First of all, you did fairly well with the situation you found yourself in. I would have done pretty much the same

Do you remember what was there?
Did /home have a separate partition? If so, concentrate on that. I am presuming you are a home user, and that's where your valuable stuff should be.

I would forget the installation. Data recovery on ext3 is not great. There are some programs out there; you set them running, and they try to assemble files, while you get on with life. I wish you luck.
 
Old 07-13-2009, 04:02 PM   #3
Jerblue
LQ Newbie
 
Registered: Jul 2009
Location: San Diego, CA
Distribution: Fedora
Posts: 6

Original Poster
Rep: Reputation: 0
The lost data was actually just a partition where I dumped a bunch of data. There was no previous Linux installation or anything. There were a number of folders, all located in /.

I have the feeling that I may have to get on with life. The funny thing is, I was reinstalling Fedora because I just replaced a bunch of hardware to facilitate a way to back up all of my data!!!! I didn't quite make it that far!

Do you happen to know any decent "set it at forget it" programs that don't only run on Windows, something that would run on Fedora in particular?

Thanks for your help.
 
Old 07-13-2009, 05:29 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,311
Blog Entries: 54

Rep: Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860
"Restoring" to the same partition that you want to recover from is a bad mistake as it overwrites data *yet again*. Searching LQ with terms like HELIX, KNOPPIX, Photorec shows data recovery unfortunately is a subject you can find many threads about. Hook up a (external) drive, boot your Live CD, read 'man photorec' (or their Wiki) to get the idea, then run 'photorec' on the disk and recover files to your other medium.
 
Old 07-13-2009, 06:24 PM   #5
Jerblue
LQ Newbie
 
Registered: Jul 2009
Location: San Diego, CA
Distribution: Fedora
Posts: 6

Original Poster
Rep: Reputation: 0
Thank you for your input. I had similar thoughts about recovering to the same disk, but unfortunately that was after the deed had been done. I did take a look at Photorec, but something gave me the impression that it wasn't going to work for me and after the semi-failed attempt with testdisk, I didn't pursue it any further. Based on your suggestion, I will give it a go for real this time

Thanks.
 
Old 07-14-2009, 12:02 PM   #6
Jerblue
LQ Newbie
 
Registered: Jul 2009
Location: San Diego, CA
Distribution: Fedora
Posts: 6

Original Poster
Rep: Reputation: 0
Quick update: Thank you to unSpawn. I ran PhotoRec and it seems to have recovered most, if not all of my data. Unfortunately, it seems as the majority of the data is unusable. First off, none of the files maintained the original file names, which I expected; however, it makes re-organizing 30,000 files difficult. More importantly however, it doesn't seem to have been able to properly recover because although the file sizes seem to be correct, the files themselves seem to be corrupt. All media files for example are far too short in length (~5-25 seconds) and the audio/video are scrambled beyond recognition. So, needless to say, it sounds like I'm stuck unless anyone has any other ideas. Thank you again guys, without your help I would not have gotten as far as I did.
 
Old 07-14-2009, 12:53 PM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,311
Blog Entries: 54

Rep: Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860Reputation: 2860
In sort of laymans terms: when a partition is formatted it gets a mesh or web-like structure consisting of metadata, inodes, (..). Data sits in the "holes" in that structure. Files are listed (linked) from the metadata of the directory they reside in. If that listing becomes illegible then files effectively become "unlinked", orphaned. Small files may occupy a few blocks. Large files occupy blocks but also blocks that are referenced in earlier blocks. If a file occupies a continguous area or is easily recognizable then file carvers like photorec, foremost or scalpel will have no problem "walking" the chain of blocks to recover files. But if one of the blocks that references other blocks goes AWOL, then the "walking" ends there. With a (any) copy of metadata I'd be desperate enough to restore it to a cloned disk and see what that would get me. If I had a backup I would hash archive contents chunked at the blocksize level and compare disk contents (see sha512deep). Without anything there is not much you can do except get a second opinion from a professional firm specialized in recovery. Recovery might be expensive but an intake assessment might cost you a few hundred bucks.

In more than one way everything has its price...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ext3 Data Recovery, Old Partition anonymous_noob_01 Linux - Hardware 1 02-07-2008 07:30 PM
data recovery of ext3 partition awalp Linux - Software 14 09-04-2007 05:07 PM
Changed Partition Table Data Recovery Ext3 demmylls Linux - General 1 03-07-2007 05:44 AM
ext3 data recovery? hollywoodb Linux - General 4 03-28-2006 04:41 AM
Help! Data Recovery - NOT a partition fault - ext3 carthaginian Linux - Newbie 0 10-16-2004 09:13 AM


All times are GMT -5. The time now is 11:38 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration