LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-05-2013, 03:39 AM   #1
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Rep: Reputation: Disabled
Help! I Formatted my /Backup Drive in Error


I did an OS reload on my CentOS Server and mistakenly ran mkfs -t ext3 on my backup drive prior to mounting it. All the data has been wipe off and I have no remote backup.

Is it still possible to recover my data? Any help would be appreciated.

Thanks
 
Old 05-05-2013, 04:13 AM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 15,056

Rep: Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915Reputation: 1915
We are to assume you have not written anything (else) to the filesystem ?.

Back it up with something like "dd". Before you do anything else.
I have had success with "mkfs -S ..." - that's a capital S; see the manpage for details and warnings. This may recover everything if you're lucky - it has in my testing on ext3.
Else you'll need to look at file scraping - photorec or one of the forensic tools.

Now about them backups in the desk drawer that you can't accidentally write over ...
 
Old 05-05-2013, 04:51 AM   #3
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by syg00 View Post
We are to assume you have not written anything (else) to the filesystem ?.

Back it up with something like "dd". Before you do anything else.
I have had success with "mkfs -S ..." - that's a capital S; see the manpage for details and warnings. This may recover everything if you're lucky - it has in my testing on ext3.
Else you'll need to look at file scraping - photorec or one of the forensic tools.

Now about them backups in the desk drawer that you can't accidentally write over ...
Many Thanks for your response. Are you into Data Recovery? Can you recommend any? The Hard Drive is on my Server and I hope it can be fixed remotely.

I installed testdisk but it could not find any file or directory but i did not make any changes.
 
Old 05-05-2013, 06:11 AM   #4
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
Hello,

I have done an image backup of the drive. So how do I proceed?

Thanks
 
Old 05-05-2013, 06:20 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Quote:
Originally Posted by Dataguyz View Post
I have done an image backup of the drive. So how do I proceed?
Read these two:
http://www.cgsecurity.org/wiki/Data_Recovery_Examples
http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step
And when you run the commands you need to execute Testdisk like
Code:
testdisk /debug /log /path/to/image
and recover the partition table first. Then attach testdisk.log as plain text file.
 
Old 05-05-2013, 10:53 AM   #6
travalon
Member
 
Registered: Jun 2012
Location: AZ
Distribution: Mint 13, Ubuntu
Posts: 78

Rep: Reputation: Disabled
I did almost the same thing. I had to use a 'Cough!!" WinXXXX machine and this http://www.easeus.com/landing/partit...FSU6QgodyVUAPA and it worked on my dd copy.
 
Old 05-05-2013, 11:10 AM   #7
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
Thanks a lot uspawn. Here is what I found in the logs:

Partition table type (auto): None
Disk /dev/sdb - 500 GB / 465 GiB - ST3500410AS
Partition table type: None

Analyse Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63

recover_EXT2: s_block_group_nr=0/3726, s_mnt_count=3/37, s_blocks_per_group=32768, s_inodes_per_group=16384
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 122096646
recover_EXT2: part_size 976773168
Current partition structure:
P ext3 0 0 1 60801 80 63 976773168


How do I proceed?
 
Old 05-05-2013, 11:56 AM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Looks like a disk with one partition on it. Since you have a backup I'd suggest letting it recover the partition boundaries and write a partition table. Note writing the partition table won't automagically "fix" things but it won't harm the data inside the partition either. After that if 'blockdev --rereadpt /dev/device' doesn't reread the partition table you may have to reboot or dis / reconnect the device. If you can now read the partition table have testdisk enter the partition and see if you can browse the file system (don't post but attach log). If that doesn't work run, like syg00 said, 'mke2fs -n -S /dev/device_partitionname' and note the super block positions. Then run e2fsck on the partition with one of the spare super blocks BUT USE THE "-v -n" switches no NO OTHER ones: 'e2fsck -n -v -b superblockpostition /dev/device_partitionname 2>&1 | tee /tmp/e2fsck.log' and show us the logs. (Again don't post but attach log files).
 
Old 05-05-2013, 12:37 PM   #9
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by unSpawn View Post
Looks like a disk with one partition on it. Since you have a backup I'd suggest letting it recover the partition boundaries and write a partition table. Note writing the partition table won't automagically "fix" things but it won't harm the data inside the partition either. After that if 'blockdev --rereadpt /dev/device' doesn't reread the partition table you may have to reboot or dis / reconnect the device. If you can now read the partition table have testdisk enter the partition and see if you can browse the file system (don't post but attach log). If that doesn't work run, like syg00 said, 'mke2fs -n -S /dev/device_partitionname' and note the super block positions. Then run e2fsck on the partition with one of the spare super blocks BUT USE THE "-v -n" switches no NO OTHER ones: 'e2fsck -n -v -b superblockpostition /dev/device_partitionname 2>&1 | tee /tmp/e2fsck.log' and show us the logs. (Again don't post but attach log files).
How do I write the partition table? Testdisk does not pop up the write option after all the Searches. It just shows the mistakenly created P ext3 0 0 1 60801 80 63 976773168.

Thanks

Last edited by Dataguyz; 05-05-2013 at 12:42 PM. Reason: typo
 
Old 05-05-2013, 04:13 PM   #10
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Can you confirm is this a disk which originally had just one partition that spanned the whole drive and if not, what was the layout? Perform a quick search then select the "Deeper search" to see if it can find those partitions. Once its finished you should have a "Write" option to write the partition table. You should have an idea what partitions the disk previously held though.
 
Old 05-05-2013, 04:51 PM   #11
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by unSpawn View Post
Can you confirm is this a disk which originally had just one partition that spanned the whole drive and if not, what was the layout? Perform a quick search then select the "Deeper search" to see if it can find those partitions. Once its finished you should have a "Write" option to write the partition table. You should have an idea what partitions the disk previously held though.
Yes, it was a single partition disk used for backup. When running deepsearch this appears:

Linux 0 0 1 60801 80 63 976773168

But the moment the search is done it disappears.

Thanks
 
Old 05-05-2013, 07:21 PM   #12
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
I have now been able to rebuild the table but testdisk now says:

No ext2, JFS, Reiser, cramfs or XFS marker

Last edited by Dataguyz; 05-05-2013 at 11:46 PM.
 
Old 05-06-2013, 12:24 AM   #13
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
Here is the log of e2fsck.
Attached Files
File Type: log scan.log (712 Bytes, 15 views)
 
Old 05-06-2013, 02:39 AM   #14
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Data recovery is always a difficult and hazardous operation to guide. Difficult because we aren't there to look over your shoulder to see what actual commands you type and hazardous because the wrong command can lead to disastrous results. That's why I, from reply one, asked you to attach log files to be able to follow things closely. Your fsck log file shows the current file system only uses 11 inodes, meaning it's looking at the reformatted super block. We don't know how you formatted your backup device in the first place but if you actually ran
Quote:
Originally Posted by Dataguyz View Post
mkfs -t ext3
on your backup drive when reformatting it (not a partition like /dev/sdb1 but the whole /dev/sdb block device and using no other flags) then it could be mke2fs selected the default block size (512 bytes) instead of the 4K this drive seems to need. Since you have a backup of the drive you should be able to use '(s)fdisk' on /dev/sdb, check the partition table
Code:
sfdisk -l /dev/sdb 2>&1 | tee -a /tmp/output.txt
, run
Code:
man fsdisk
, run
Code:
fdisk -b 4096 /dev/sdb
, delete any partitions if listed, create a partition spanning the whole disk, mark it as ext2 and save the partition table. Now list the partition table again and run
Code:
mke2fs -n -S /dev/sdb1 2>&1 | tee -a /tmp/output.txt
and attach "/tmp/output.txt" plus the relevant parts of running
Code:
history 2>&1 | tee -a /tmp/output.txt
to your reply.
 
Old 05-06-2013, 03:32 AM   #15
Dataguyz
LQ Newbie
 
Registered: May 2013
Posts: 13

Original Poster
Rep: Reputation: Disabled
Here is what the output log says. Can I PM you? You appear to be a pro. I am willing to pay for your service.

Thanks
Attached Files
File Type: log output.log (892 Bytes, 15 views)

Last edited by Dataguyz; 05-06-2013 at 03:39 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
i formatted My C Drive now cant log into linux. hunnykhan3 Linux - Newbie 8 08-31-2009 02:38 PM
Can't acces disk drive [formatted pc] Darkmystery Slackware - Installation 4 03-05-2008 09:21 AM
Linux Tape Drive Backup Error chunsa Linux - Newbie 2 02-20-2008 07:59 PM
accidentally formatted drive jb1390 Linux - Hardware 8 12-31-2005 02:47 PM
External drive will not backup when formatted to VFAT32 linuxmarine Linux - Hardware 1 03-25-2005 05:50 AM


All times are GMT -5. The time now is 12:22 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration