LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
Search this Thread
Old 08-02-2007, 08:12 PM   #1
awalp
LQ Newbie
 
Registered: Aug 2007
Posts: 3

Rep: Reputation: 0
data recovery of ext3 partition


I need some assistance on recovering data from some ext3 partitions. I accidently formatted two 250gb /dev/sda partitions with reiserfs, when they were already formatted ext3 and full of data during some routine maintenance work. How can I recovery my 500gb of data?
 
Old 08-02-2007, 08:17 PM   #2
PatrickNew
Senior Member
 
Registered: Jan 2006
Location: Charleston, SC, USA
Distribution: Debian, Gentoo, Ubuntu, RHEL
Posts: 1,148
Blog Entries: 1

Rep: Reputation: 48
Whatever you do, do not mount those partitions. It can cause data loss. If all you do is mount, the loss will likely be minimal, but best if you can avoid it. Try looking into a tool called foremost. It scans the raw data on the drive and tries to recognize files.
 
Old 08-02-2007, 09:30 PM   #3
jay73
Guru
 
Registered: Nov 2006
Location: Belgium
Distribution: Ubuntu 11.04, Debian testing
Posts: 5,019

Rep: Reputation: 130Reputation: 130
Photorec tends to work even better than foremost. Just bear in mind that you'll need at least 2x 250GB empty space to save the recovered files to.
 
Old 08-03-2007, 05:38 AM   #4
awalp
LQ Newbie
 
Registered: Aug 2007
Posts: 3

Original Poster
Rep: Reputation: 0
I tried out both pieces of software suggested. Foremost seems to be nice in the fact it sorts files into directories by type, and preserves the original name, but it is limited in the files it recovers.

the photorec software seems to be able to recover all my file types, but the problem is it recovers each file by putting a number and extension, nothing more, and 500gb of 123435324.ext, with mostly organized websites in folders isn't really much of a recovery.

I'm looking for a way to preserve the original directory structure and file names with the recovery.
 
Old 08-03-2007, 05:56 AM   #5
jay73
Guru
 
Registered: Nov 2006
Location: Belgium
Distribution: Ubuntu 11.04, Debian testing
Posts: 5,019

Rep: Reputation: 130Reputation: 130
I'm sorry but that won't work. The file names and folder directories are located at the start of a partition - and that's the part that gets wiped during a format so that space is created for a new "table of contents". You will be able to recover the files but their names are lost.
 
Old 08-03-2007, 02:55 PM   #6
PatrickNew
Senior Member
 
Registered: Jan 2006
Location: Charleston, SC, USA
Distribution: Debian, Gentoo, Ubuntu, RHEL
Posts: 1,148
Blog Entries: 1

Rep: Reputation: 48
Depending on how important it is, all may not be lost. Immediately remove the drive from a machine and contact a professional. There exists equipment to read overwritten data on a hard drive. But if this is just your home PC, it's not worth the cost. Expect to pay hundreds of dollars, minimum.
 
Old 08-04-2007, 02:05 AM   #7
awalp
LQ Newbie
 
Registered: Aug 2007
Posts: 3

Original Poster
Rep: Reputation: 0
by formatting the drive over, I thought it just changed the partition information.

I switched the partition type back to ext2 and tried to recover the partition using alternative superblocks located throughout the drive but ended up with an empty partition.

There must be a way to recovery the data, at least from the other drive that I did not work on yet, 3 seconds of accidental formatting could not of erased 250gb of data.

I need to somehow recreate the ext3 map of the drive.
 
Old 08-04-2007, 03:31 AM   #8
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,203

Rep: Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015Reputation: 1015
Quote:
Originally Posted by awalp
by formatting the drive over, I thought it just changed the partition information.
You thought wrong.
Quote:
There must be a way to recovery the data, at least from the other drive that I did not work on yet, 3 seconds of accidental formatting could not of erased 250gb of data.

I need to somehow recreate the ext3 map of the drive.
See jay73's post above.
 
Old 08-04-2007, 06:29 AM   #9
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,118
Blog Entries: 54

Rep: Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786Reputation: 2786
Noticing you talk about websites, renaming could be done if the websites where uploaded to a remote location. Then you could 'md5deep' the remote files and compare hashes with locally recovered files. Just an idea.
 
Old 08-31-2007, 08:03 PM   #10
zzzptg
LQ Newbie
 
Registered: Aug 2007
Posts: 13

Rep: Reputation: 0
hello

i'm getting the same problem, after the disk pressisted to be always full, even when deleted some folders
I decided to delete all the folders except the /home ......

Well now i cant even mount the disk
and e2fsck gives me a bunch of errors, even using the backup superblocks

Code:
[admin@myasus root]$ fsck.ext3 -b 32768 /dev/discs/disc0/part5
e2fsck 1.38 (30-Jun-2005)
Inode table for group 0 is not in group.  (block 1177535144)
WARNING: SEVERE DATA LOSS POSSIBLE.
Relocate<y>? 

.....
e2fsck: e2fsck_read_bitmaps: illegal bitmap block(s) for MyBook
got a 250GB disk full of stuff, dont want to lose it

In my search found this sites, may be helpful for somebody

Hack 94. Recover Data from Crashed Disks

LiveCD - (R)ecovery (I)s (P)ossible Linux rescue system
 
Old 09-01-2007, 11:42 AM   #11
zzzptg
LQ Newbie
 
Registered: Aug 2007
Posts: 13

Rep: Reputation: 0
i dont even have the lost+found folder

i'm still hoping to recover...
Quote:
What kind of files do you want to recover? Here's my process for general purpose recovery:

1) make an image with dd_rescue
2) run testdisk on the image
3) run foremost on the image
4) run photorec on the image

Photorec and Testdisk are both by the same author. Foremost is a data recovery tool developed by the US Airforce (I think). Typically I'm just recovering jpegs, movies, documents, etc.
https://help.ubuntu.com/community/DataRecovery
 
Old 09-02-2007, 06:36 AM   #12
AwesomeMachine
Senior Member
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian jessie/sid; OpenSuSE; Fedora
Posts: 1,591

Rep: Reputation: 162Reputation: 162
You can put an ext3 file system back on the two drives, which has a negligible effect on the data, and use fsck.ext3 --rebuild tree /dev/sda. I think the command is a little different than .ext3, but you can look it up, man fsck. Rebuild tree turns all the leaf nodes in the file system back into files, by reading every one of them. I recovered most of a previous installation after I reformatted, and installed linux over an existing installation. Then I remembered I needed something from the old installation, so I used a live cd, and fsck to rebuild everything that wasn't written over. I got the file back, and I just left everything else. It was sweet. Don't worry about mounting. You've really messed up. I don't think a few more lost bytes will hurt you.
 
Old 09-03-2007, 08:28 AM   #13
zzzptg
LQ Newbie
 
Registered: Aug 2007
Posts: 13

Rep: Reputation: 0
Using DiskInternals Linux recovery, i'm able to recover many files...
But no file names or directories.

I want to recover mostly avi files, but when it recovers, the files comes broken.
The metadata (resolution, and length of movie) are correct, but when i play anly has 3 seconds black...
Tried VirtualDub, but no chance
 
Old 09-04-2007, 03:55 PM   #14
zzzptg
LQ Newbie
 
Registered: Aug 2007
Posts: 13

Rep: Reputation: 0
Somebody with the same problem resolved this way:

http://shon.org/blog/?p=25
Quote:
[root@adrock init.d]# dd if=/dev/ida/c0d0p7 of=/big/var.bak.dd
530368+0 records in

Still hosed, but now I have a backup of the burnination. And now for the FIX!!!

mke2fs -S /dev/ida/c0d0p7
mke2fs 1.27 (8-Mar-2002)
Filesystem label=
OS type: Linux
Block size=1024 (log=0)
Fragment size=1024 (log=0)
66528 inodes, 265184 blocks
13259 blocks (5.00%) reserved for the super user
First data block=1
33 block groups
8192 blocks per group, 8192 fragments per group
2016 inodes per group
Superblock backups stored on blocks:
8193, 24577, 40961, 57345, 73729, 204801, 221185

Writing superblocks and filesystem accounting information: done

That did it! mke2fs re-wrote all of the superblocks and group descriptors and I was able to mount in RO mode and copy off the data. After that I was able to fsck and remount the original parition with no problems!

other case:
http://user-mode-linux.sourceforge.net/old/sdotm.html

Last edited by zzzptg; 09-04-2007 at 04:58 PM.
 
Old 09-04-2007, 05:07 PM   #15
zzzptg
LQ Newbie
 
Registered: Aug 2007
Posts: 13

Rep: Reputation: 0
WEEEEEE

SUCCESS NOT


Solution (make backups if you can )
mke2fs -S /dev/ida/c0d0p7

fsck ...

mount



bahh
it seems to only recovered some files ....
i can see all the folders but some of them are unredable

i though ive recovered, all the files, but it seems that only 23GB of the 250GB are visible
will backup the recovered data, and them I will run again fsck to see if fixes more problems..

Last edited by zzzptg; 09-07-2007 at 04:34 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Best Live/Rescue CD for ext3 data recovery? branvu Linux - Distributions 12 07-02-2010 08:37 AM
Changed Partition Table Data Recovery Ext3 demmylls Linux - General 1 03-07-2007 05:44 AM
Data Recovery software in Linux for ext3/NTFS? Raveolution Linux - Software 3 10-15-2006 02:21 AM
ext3 data recovery? hollywoodb Linux - General 4 03-28-2006 04:41 AM
Help! Data Recovery - NOT a partition fault - ext3 carthaginian Linux - Newbie 0 10-16-2004 09:13 AM


All times are GMT -5. The time now is 05:00 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration