Quote:
Originally Posted by sussane
i issued the commands below and now i can't find the ISO files  on the hard disk. |
Laying down a filesystem structure over the old one does not make sense.
If you don't understand what a command does then please think first, then read about it and then ask if unsure.
Quote:
Originally Posted by sussane
i unmounted the drive and tried to mount again, but failed.
|
Give us (exact!) (error) messages to work on, not a vague description.
Quote:
Originally Posted by sussane
How can i use testdisk OR other free datarecovery softwares to recover all the .ISO files
|
The "how" of how to operate testdisk or gpart you can read in the manual, it isn't that hard to operate.
If unsure make a 'dd' copy of the disk to file so you have a backup to work on if you fsck up again.
Another option would be retrieving files directly with photorec or foremost or scalpel. These tools carve (string together bits of files) by looking for the start and end of file (file header and footer information, think "magic" as in the 'file' command). The problem is that finding an end-of-file marker however does not guarantee file integrity in any way: it may be missing pieces or stray data may have been trapped in it. (For OS install .iso's that would be easy to verify since the D/L page will list a MD5 or SHA1 hash value.) Another problem is (and I only tested this on a few .iso's) that neither photorec or foremost or scalpel has ready-made header plus footer for ISO 9660 and that header/footer carving relies on the signature starting in the first two bytes AFAIK, and with an ISO 9660 format file that's simply not the case, the first column represents the offset in the file where the string "CD001" is found:
Code:
grep -i 9660 /usr/share/magic
32769 string CD001 ISO 9660 CD-ROM filesystem data
37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
So that's a bit of a dead. (That doesn't mean you could not retrieve data *from* a deleted iso since it's a simple filesystem. Mkisofs some dir with text files then grep the iso for a line and you'll see.) File carving may be helpful if the value of the data is greater than the time you have to invest in prepping and carving. But since these are readily available .iso's I'd say D/L them again. Besides that I've been only doing Forensics for so long. Maybe someone else has better ideas.
