Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Searching LQ and looking at the bottom of this page in the "Similar Threads" will yield a ton of posts about 'photorec', its companion app 'testdisk' and much more. But maybe it would be best if you start by trying to explain what exactly happened. That makes it easier to post more specific information.
'TestDisk' is a good utility to recover files or data when possible. Even if you formatted and did not write to the hdd then you possibly can recover some and possibly all of the data on the desired filesystem.
Thanks for the replies. Basically, to cut a long story short, i accidentally, partially formatted a vfat partition to ntfs. I turned off the laptop just after i realised but by then the damage had been done. Although the drive is recognised (have set it up in a USB drive), it has no directory structure or anything. I have not written anything else to the drive since.
To get the drive recovered commercially is going to cost a lot of money and since i am a linux user i thought there must be a linux solution although i hadnt found one that seemed to work.
I will investigate "testdisk" - does this have the ability to resurect the original directory structure (aparently this is the best option) or take the files off in raw format (but then i have no idea how to get them back to the format they were in).
Searching LQ will yield some posts about accidentally formatted partitions. Basically formatting a filesystem overlays a mesh, a web-like structure, over disk contents (in contrast to zeroing out a partition which destroys filesystem contents). So everything not touched by the structure is more or less available. The problem is that entities are linked to their parent. For example a file is "linked" to it's parent (a directory) and a subdirectory is linked to its parent (a directory) as well. To confuse you even more, files which size exceeds a certain size will be broken up and "recorded" in different parts of the filesystem and those parts may be linked directly or indirectly. Removing the existing filesystem hierarchy and structure on disk (by formatting) destroys those links. Photorec (or foremost, scalpel, pyFLAG, et cetera) will try to determine the start and end of a file looking for distinct header and footer signatures (called carving). This is kind of a brute-force approach since not all files have distinct header and footer signatures and if there's files mixed in between they may be carved as part of the resultant file as well.
The best way to procede would be to boot a Live CD and make a bit-by-bit copy of the disk to another separate physical medium (removable USB storage?) before doing anything else with the machine. This way you always have a backup to fall back on might the need arise.
The first program i ever made in perl was for file recovery. It's not very good so I use foremost. You can recover specific filetypes with foremost such as all .doc files for example or a range of filetypes
That's one of the basic reasons to have a LiveCD like 'UBCD' or 'SystemRecueCD' on hand whenever you need to boot. So you have utilities to perform recovery, fix or whatever on a 'unmounted filesystem.
I recommend that all users should download a Utility LiveCD before you have any kind of problem. Hopefully you will never need it in a emergency but use it to aid in maintenance of your system(s).