SlackwareThis Forum is for the discussion of Slackware Linux.
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
I screwed up and managed to overwrite my MBR with one that had a different partition table, thereby losing access to all of my partitions and data.
Now, I was semi-smart and backed up the MBR before I did this, but the "semi-" part is that I backed it up onto the hard drive in question because I was thinking only in terms of losing my ability to boot from the MBR, not the whole partition table.
So...as I see it my only means to recover my data is to find and recover that 512 byte block on the disk media. Having read a little bit, this seems possible given that I know to look for a) the MBR signature at offset 510, b) the partition status byte at offset 446, and c) the partition type byte at offset 450.
What I need is help figuring out the most efficient way to do this. I've experimented with a shell script using dd, hexdump, and grep, but searching 1000 blocks takes ~20seconds, so to search the whole drive (100GB) will take something like 800hrs. This is limited, I believe, by the fact that my live disk of Knoppix won't recognize a drive on the SATA bus, so I had the target drive mounted through a USB adapter. But even if it were being accessed via SATA, I have a feeling it would be pretty slow.
I need someone who is an expert to help me figure out a script, program, etc. that can search for and identify the sector where my MBR backup resides more efficiently.
how much data was on it before the "DOH!" moment?
if it was not full, then it's possible if it was one of the last files written, so it may be somewhere near the end of used space. that might narrow down your search somewhat. it could be somewhere else in the partition, but that's where i would look first. erased files leave gaps that the system eventually overwrites with new data, so it could really be anywhere. i don't know how linux prioritizes the overwrites, but a 512 byte file is small enough that it might just have tacked it on to the end of the "used" space (on the other hand a 512 byte file is small enough to grab contiguous space anywhere, especially amongst the "deleted" spaces)
I should have mentioned testdisk will take only a matter of a few minutes. Once the part table is rebuilt, just mount the filesystem to find your backup file. Which of course will no longer be needed ...
Thanks for all the responses and suggestions. testdisk sounds very useful, indeed. As it happens, prior to coming back to check this thread I wrote a little C program that ended up doing what I needed. Similar concept to what I had tried to do in a script before, but ran much, much faster as an executable (maybe not surprising).
syg00, the Knoppix I had was ancient - whatever I had lying around already - version 4.x or something.
Thanks again, folks. I think I'll burn a new LiveCD with some disk rescue tools on it for the future.