LInux file system overwritten by ntfs
 

I recently accidently installed windows 7 ntfs over my ext4 file system. Is there a free utility to recover my ext4 files after they have been overwritten by ntfs. I need a program that will work from the Windows environment but it needs to recover my /home directory from Fedora 14.

Several generic points:

If you installed Windows on top of the old files, then trying to recover while running Windows will reduce the odds of recovery. In fact, you should not be running Windows at all---for anything.

Depending on the size and location of the old and new partitions, there's a chance of recovering at least some data----the point is that installing a filesystem does not necessarily wipe out old data.

I would NOT expect that you would recover any of the old filesystem structure---only individual files.

How to proceed:

1. Do not use that disk for anything---attempt the recovery only while running from a different disk, Live Linux CD, etc.

2. If the data is really valuable, then clone the disk before tryig anything.

3. the most commonly cited tools are photorec and testdisk---read up on them here: http://www.cgsecurity.org/wiki/Main_Page

This could be read (at least) two different ways.
- if you actually installed the full Win7, you have overwritten a large portion of that ext4 filesystem. That portion is gone forever - no prospect of recovery. For the rest, try as above.
- if you merely re-formatted as NTFS (without actually writing any files), you may have a better chance. Again see the above, but in addition mkfs.ext4 has a "-S" (note that's a upper case ess) option. Be aware of the warnings in the manpage. Some time ago I tested this on ext3 after deliberately re-formatting as NTFS and it worked for my test-case.

I guess you never bothered with backups ?.

I still laugh when I see good Windows insults.


This helps. However, to build on it, I would say, that if the data is very valuable, VERY, VERY, Valuable, Turn off the computer and take the drive out and take it to a data recovery lab. Expensive, but worth it.

[QUOTE=szboardstretcher;4707460]I still laugh when I see good Windows insults.

!!! I honestly did not mean it that way---but I see how it could be read. The point was that while running Window, files can be written to the disk

I'd agree that the chances are slim---but maybe not zero. What I'm thinking is that a filesystem stores data where it finds space---until the partition is full, the old data is still intact. (my understanding is that the creation of a filesystem, while it does wipe out the old filesystem---does not necessariy wipe out all the data.)

The bits that are overwritten are gone - the bits that aren't overwritten may be recoverable.
That's what I said.

Right......

I'm suddenly wondering what happens when a old file gets some new data written into the middle of it. In this case, photorec would still find the beginning of the file----but would it have any way of know that some of the data was not part of that new file?

No, Photorec recognizes files only with using the commonly known headers/endings/whatever, but it doesn't care about the contents. This may end in Photorec "recovering" a file that is unusable because it is partially over-written or was fragmented.

In a very true sense it could be recovered 100%. I doubt anyone here could do it unless they had access to some very specialized hardware. Companies charge like $1500 or more to recover disks. They have a special magnetic detection that tries to find out what the disk was along with software.

Can you do it? Kind of doubtful but if the data is untouched by reason of the same disk geometry then maybe. Undoing a partition and recreating it gets a bit more difficult but not much more.