LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices



Reply
 
Search this Thread
Old 11-02-2010, 09:28 PM   #1
xflow7
Member
 
Registered: May 2004
Distribution: Slackware
Posts: 161

Rep: Reputation: 21
Need to search harddrive for MBR backup.


I screwed up and managed to overwrite my MBR with one that had a different partition table, thereby losing access to all of my partitions and data.

Now, I was semi-smart and backed up the MBR before I did this, but the "semi-" part is that I backed it up onto the hard drive in question because I was thinking only in terms of losing my ability to boot from the MBR, not the whole partition table.

So...as I see it my only means to recover my data is to find and recover that 512 byte block on the disk media. Having read a little bit, this seems possible given that I know to look for a) the MBR signature at offset 510, b) the partition status byte at offset 446, and c) the partition type byte at offset 450.

What I need is help figuring out the most efficient way to do this. I've experimented with a shell script using dd, hexdump, and grep, but searching 1000 blocks takes ~20seconds, so to search the whole drive (100GB) will take something like 800hrs. This is limited, I believe, by the fact that my live disk of Knoppix won't recognize a drive on the SATA bus, so I had the target drive mounted through a USB adapter. But even if it were being accessed via SATA, I have a feeling it would be pretty slow.

I need someone who is an expert to help me figure out a script, program, etc. that can search for and identify the sector where my MBR backup resides more efficiently.

Any ideas/suggestions *very* much appreciated.

Thanks!

Dave

Last edited by xflow7; 11-02-2010 at 09:31 PM.
 
Old 11-02-2010, 10:31 PM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,497

Rep: Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077
Go find a liveCD with testdisk on it. It'll scan the disk and rebuild the partition table for you.

Edit: which Knoppix ?. Should find SATA o.k., and used to even have testdisk on it.
(just tested Knoppix 6.2, it has testdisk on it - I always run it as root)

Last edited by syg00; 11-02-2010 at 10:39 PM.
 
Old 11-02-2010, 10:41 PM   #3
unclejed613
Member
 
Registered: Mar 2009
Posts: 326

Rep: Reputation: 26
how much data was on it before the "DOH!" moment?
if it was not full, then it's possible if it was one of the last files written, so it may be somewhere near the end of used space. that might narrow down your search somewhat. it could be somewhere else in the partition, but that's where i would look first. erased files leave gaps that the system eventually overwrites with new data, so it could really be anywhere. i don't know how linux prioritizes the overwrites, but a 512 byte file is small enough that it might just have tacked it on to the end of the "used" space (on the other hand a 512 byte file is small enough to grab contiguous space anywhere, especially amongst the "deleted" spaces)
 
Old 11-02-2010, 10:56 PM   #4
allend
Senior Member
 
Registered: Oct 2003
Location: Melbourne
Distribution: Slackware-current
Posts: 3,520

Rep: Reputation: 876Reputation: 876Reputation: 876Reputation: 876Reputation: 876Reputation: 876Reputation: 876
Perhaps you could try 'find / -type f -size 512c -print' to get a list of all files 512 bytes in length.
Should be quicker than 800 hours.
 
Old 11-02-2010, 11:09 PM   #5
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,497

Rep: Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077Reputation: 1077
I should have mentioned testdisk will take only a matter of a few minutes. Once the part table is rebuilt, just mount the filesystem to find your backup file. Which of course will no longer be needed ...
 
Old 11-03-2010, 05:48 AM   #6
hughetorrance
Member
 
Registered: Aug 2009
Location: London North West
Distribution: x86_64 Slack 13.37 current : +others
Posts: 459

Rep: Reputation: 59
Parted Magic live CD has testdisc on it... and other very useful tools... ! can be burned to a CD or installed on a USB thumb drive with the onboard unetbootin.
 
Old 11-04-2010, 06:45 AM   #7
xflow7
Member
 
Registered: May 2004
Distribution: Slackware
Posts: 161

Original Poster
Rep: Reputation: 21
Thanks for all the responses and suggestions. testdisk sounds very useful, indeed. As it happens, prior to coming back to check this thread I wrote a little C program that ended up doing what I needed. Similar concept to what I had tried to do in a script before, but ran much, much faster as an executable (maybe not surprising).

syg00, the Knoppix I had was ancient - whatever I had lying around already - version 4.x or something.

Thanks again, folks. I think I'll burn a new LiveCD with some disk rescue tools on it for the future.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
old linux harddrive, re-installing winxp (no mbr) chovy Linux - Hardware 2 06-08-2006 03:26 AM
I have a harddrive that I want to search for deleted word files, what do I do first? abefroman Linux - Security 2 07-31-2005 08:37 PM
MBR zeroed. Can I verify backup MBR? TomF Linux - General 7 06-20-2005 06:28 PM
Harddrive backup Meatball1337 Linux - Software 1 10-15-2004 12:29 AM
New HardDrive and MBR garr0323 Linux - Hardware 2 02-12-2004 06:59 AM


All times are GMT -5. The time now is 08:13 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration