-   Linux - Newbie (
-   -   help me recover my data, please (

indeedio 03-19-2006 01:11 PM

help me recover my data, please
Hello Linux gurus.I'm hoping someone can help me recover my data. Here is what happened:

A few months back I installed Ubuntu. I played around with it but I messed it up.I decided to try out another distro. No sweat, I thought, I'll just reformat the partition and start over.

I tried Qtparted in Knoppix to create a partition but the option was graeyed out so I went to Winwoes and used disk manager to erase my Linux partition. i decided i wanted a larger swap and tried to delete it but windows also deleted my partition with my documents. i guess because they both were in a extended partition.

I have a back up of my partition table but i can't get sfdisk to write it to disk. I don't know what i'm doing wrong, can someone help? i don' want to lose all my data when I think it's all still there.


uselpa 03-19-2006 01:35 PM

What form is the backup of your partition table, and how was it done? If it is a simple file, what is the size of the file?

indeedio 03-19-2006 02:00 PM

hi thanks for replying.the backup wasit was done using "sfdisk -d /dev/hda > backup" I guess it's a simple file. it says it's 432 B

Here are it's contents:
Warning: extended partition does not start at a cylinder boundary.
DOS and Linux will interpret the contents differently.
# partition table of /dev/hda
unit: sectors

/dev/hda1 : start= 63, size= 15406272, Id= 7, bootable
/dev/hda2 : start= 27276480, size=129019905, Id= f
/dev/hda3 : start= 0, size= 0, Id= 0
/dev/hda4 : start= 0, size= 0, Id= 0
/dev/hda5 : start= 27276543, size=129019842, Id= 7

i tried using cat backup | sfdisk -d /dev/hda like some websites sais but the partition table stay s the same.

I'm also trying gpart and here is what it gave me when using "gpart -i

Begin scan...
Possible partition(Windows NT/W2K FS), size(5514mb), offset(7522mb)

Accept this guess (y,n) : y

Possible partition(Linux swap), size(274mb), offset(13037mb)

Accept this guess (y,n) : y

Possible extended partition at offset(13318mb)

Accept this guess (y,n) : y

Possible partition(Windows NT/W2K FS), size(62997mb), offset(13318mb)

Accept this guess (y,n) : y

* Warning: short read near sector(156301299), 64512 bytes instead of 66048. Skipping...
End scan.

Checking partitions...
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Partition(Linux swap or Solaris/x86): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary

Guessed primary partition table:
Primary partition(1)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 5514mb #s(11293688) s(15406335-26700022)
chs: (1023/15/63)-(1023/15/63)d (15284/1/1)-(26488/1/56)r

Primary partition(2)
type: 130(0x82)(Linux swap or Solaris/x86)
size: 274mb #s(562144) s(26700156-27262299)
chs: (1023/15/63)-(1023/15/63)d (26488/4/1)-(27045/14/58)r

Primary partition(3)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 62997mb #s(129018897) s(27276543-156295439)
chs: (1023/15/63)-(1023/15/63)d (27060/1/1)-(155054/15/63)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Any ideas?

lord-fu 03-19-2006 02:02 PM

If you have access to another pc with enough space on its hard drive to store the amount of data you lost. You count mount it as a slave drive and copy it over. Then when you fix it you could copy back. Kinda a pain, but I have done it a few times.
Sorry you got that one in right before me. I am no good really when it comes to partitions, Thought you were just trying to recover a windows my docs and such. So please disregard.

indeedio 03-19-2006 02:09 PM


Knoppix gives me an error message but when gpart is done i'll try it again. i have no clue how to write the partition table back to the drive though. I tried sfdisk but it doesn't seem to change it, any tips or advice? I'm really knew at this so I'm really lost. I can see that gpart identifies something but it's not the same as my partition table right?

uselpa 03-19-2006 02:11 PM


Originally Posted by indeedio
i tried using cat backup | sfdisk -d /dev/hda like some websites sais but the partition table stay s the same.

according to `man sfdisk`

-d Dump the partitions of a device in a format useful as input to sfdisk. For example,
% sfdisk -d /dev/hda > hda.out
% sfdisk /dev/hda < hda.out
will correct the bad last extended partition that the OS/2 fdisk creates.
so you should try

sfdisk /dev/hda < backup

cat backup | sfdisk /dev/hda

indeedio 03-19-2006 02:32 PM

thanks uselpa. I'll give that i try when gpart stops doing its thing. I'm crossing my fingers.

pixellany 03-19-2006 02:49 PM

One thing to consider is copying your data before you start messing around with file recovery. You can clone the drive using things like dd from a live CD---or you can clone it in another computer (cloning programs dont care what's on the disk--they just copy the bits)

Whatever you do, don't WRITE to the disk unless you are sure what you are doing.

indeedio 03-19-2006 03:24 PM

thanks for the tip,pixellany. I'll go out and buy some dvd+r to back up because i don't have other hdd. I saw that fry's had a pack of fify for six bucks.Part of the problems is that i don't really know what i'm doing. i just assume my data is still there because i only lost the partition table (right??)but i don't know anything about linux so i'm just going through the motions. Like the gpart thing above? i don't know what it means but i think it's telling me that my partitions are there. anyway, i think knoppix has a disl cloner, righ?

indeedio 03-19-2006 07:08 PM

1.well after backing up I tried uselpa's tip but this is what i got:

root@3[knoppix]# cat /home/knoppix/Desktop/workin_nov10 | sfdisk /dev/hda
Checking that no-one is using this disk right now ...

Disk /dev/hda: 155061 cylinders, 16 heads, 63 sectors/track
Old situation:
Units = cylinders of 516096 bytes, blocks of 1024 bytes, counting from 0

  Device Boot Start    End  #cyls    #blocks  Id  System
/dev/hda1          0+ 155060  155061-  78150743+  83  Linux
/dev/hda2          0      -      0          0    0  Empty
/dev/hda3          0      -      0          0    0  Empty
/dev/hda4          0      -      0          0    0  Empty

sfdisk: unrecognized input: extended partition does not start at a cylinder boundary.

Any ideas of what i'm doing wrong? Anyone?

Sören Schneider 03-27-2006 08:26 AM

Don't complicate newbies
Have a look at this:

I had the same problem with Windows.
My partitions were gone.
But then I remembered +/- of how my HD was partitioned.
It looked like this

HD with 80G

HDA1 Windows 5G VFAT
HDA2 Windows 35G
HDA5 Extended 40G
HDA7 / ReiserFS 5G
HDA8 /company 10G
HDA9 /songs the rest of HD

So I knew that my company's data was on a partition between 45G and 55G of the HD.
Then I made this:
New installation of LINUX
HDA1 Windows 5G
HDA5 Extended 75G
HDA7 / ReiserFS 5G
HDA8 /company ReiserFS 55G
HDA9 /recovery ReiserFS 15G

So all my old data should be in de "new" "/company" partition.
Log in as ROOT and install the program to (in this case HDA9 /recovery)
Please check the man page (man foremost) for details and your needs!!!!!!!

I executed this:
./foremost -v -s 50000000 -T -t jpg doc pdf -i /dev/hda8

The program started with search after block 50.000.000 created a folder with timestamp in /recovery and recovered JPGs PDFs
and DOCs

Good Luck!!!


All times are GMT -5. The time now is 02:49 AM.