Data recovery after formatting ext3 partition

First off, thank you to those that read and respond to my post. Second, I apologize in advance. I am fairly new to Linux, and even newer to the forums, so I apologize now, because I know that I will unintentionally do something that violates Linux and/or Forum etiquette. Here is my debacle:

1. When installing Fedora 11, for the second time, my installation hung when entering my root password. Being the impatient person I am, I hit enter a couple times as I was not sure what was happening. When the installer finally caught up, it was already preparing the wrong disk for the install. Immediately, I powered off and restarted the install with the only the correct hard disk connected.

2. After installing, I see one 698GB chunk of unallocated data on the disk that was wiped. No valid ext3 partitions.

3. In an attempt to recover the data I do the following:

3a. Using testdisk, the original ext3 partition is found, but cannot list the files. No other functions of testdisk produced any results, so (don't ask me why) I wrote the partition table that it did find.

3b. Going back to testdisk, I was able to now find the superblocks.

3c. I used one of the 10 or so entries listed and I ran the following: "fsck.ext3 -b 32768 -B 4069 /dev/sdb1"

4. This managed to repair some of the partition. I was able to now find ~80GB of data in the lost+found folder on the disk.

I made the mistake of running away with the information that I found while googling without really understanding what I was doing. So I'm not entirely sure if I was doing the right thing to begin with and why I only recouped 80 gigs of data. I'm looking to find ~700GB of data that I lost track of.

Can anyone point me in the direction of that data?!

Thank you so much.

Justin.

First of all, you did fairly well with the situation you found yourself in. I would have done pretty much the same

Do you remember what was there?
Did /home have a separate partition? If so, concentrate on that. I am presuming you are a home user, and that's where your valuable stuff should be.

I would forget the installation. Data recovery on ext3 is not great. There are some programs out there; you set them running, and they try to assemble files, while you get on with life. I wish you luck.

The lost data was actually just a partition where I dumped a bunch of data. There was no previous Linux installation or anything. There were a number of folders, all located in /.

I have the feeling that I may have to get on with life. The funny thing is, I was reinstalling Fedora because I just replaced a bunch of hardware to facilitate a way to back up all of my data!!!! I didn't quite make it that far!

Do you happen to know any decent "set it at forget it" programs that don't only run on Windows, something that would run on Fedora in particular?

Thanks for your help.

"Restoring" to the same partition that you want to recover from is a bad mistake as it overwrites data *yet again*. Searching LQ with terms like HELIX, KNOPPIX, Photorec shows data recovery unfortunately is a subject you can find many threads about. Hook up a (external) drive, boot your Live CD, read 'man photorec' (or their Wiki) to get the idea, then run 'photorec' on the disk and recover files to your other medium.

Thank you for your input. I had similar thoughts about recovering to the same disk, but unfortunately that was after the deed had been done. I did take a look at Photorec, but something gave me the impression that it wasn't going to work for me and after the semi-failed attempt with testdisk, I didn't pursue it any further. Based on your suggestion, I will give it a go for real this time

Thanks.

Quick update: Thank you to unSpawn. I ran PhotoRec and it seems to have recovered most, if not all of my data. Unfortunately, it seems as the majority of the data is unusable. First off, none of the files maintained the original file names, which I expected; however, it makes re-organizing 30,000 files difficult. More importantly however, it doesn't seem to have been able to properly recover because although the file sizes seem to be correct, the files themselves seem to be corrupt. All media files for example are far too short in length (~5-25 seconds) and the audio/video are scrambled beyond recognition. So, needless to say, it sounds like I'm stuck unless anyone has any other ideas. Thank you again guys, without your help I would not have gotten as far as I did.

In sort of laymans terms: when a partition is formatted it gets a mesh or web-like structure consisting of metadata, inodes, (..). Data sits in the "holes" in that structure. Files are listed (linked) from the metadata of the directory they reside in. If that listing becomes illegible then files effectively become "unlinked", orphaned. Small files may occupy a few blocks. Large files occupy blocks but also blocks that are referenced in earlier blocks. If a file occupies a continguous area or is easily recognizable then file carvers like photorec, foremost or scalpel will have no problem "walking" the chain of blocks to recover files. But if one of the blocks that references other blocks goes AWOL, then the "walking" ends there. With a (any) copy of metadata I'd be desperate enough to restore it to a cloned disk and see what that would get me. If I had a backup I would hash archive contents chunked at the blocksize level and compare disk contents (see sha512deep). Without anything there is not much you can do except get a second opinion from a professional firm specialized in recovery. Recovery might be expensive but an intake assessment might cost you a few hundred bucks.

In more than one way everything has its price...