[SOLVED] Data Recovery, formatted my ext4 as vfat by mistake

Halobok · 02-12-2012, 11:19 AM

I dont want to beg by dev/sdb1 is my life, I just run

Code:

mkfs.vfat -F 32 -n 1GBdrive /dev/sdb1

by mistake, I was meaning dev/sdc1

partition table is untouched, my partition was ext4. It there any way of restoring it as a whole, without using an extra drive. I need that data asap. I'm no expert but guessing from how little time mkfs took to complete, almost all of my data is still there.

I'm thinking about trying "mkfs.ext4 /dev/sdc1" , but not sure if it will wipe my disk even more?

troop · 02-12-2012, 12:07 PM

http://www.cgsecurity.org/wiki/Data_Recovery_Examples
look at section "Recovery of reformatted partition"

H_TeXMeX_H · 02-12-2012, 12:12 PM

Quote:

Originally Posted by Halobok

I'm thinking about trying "mkfs.ext4 /dev/sdc1" , but not sure if it will wipe my disk even more?

Do NOT run that. Use testdisk like troop suggests.

jernejp · 02-12-2012, 12:17 PM

I would recommend you to give PhotoRec a try:

http://www.cgsecurity.org/wiki/PhotoRec

if you have data that you don't want to loose it is a good idea to make a clone of the disk first (Clonezilla is a great tool for that) and then experiment with data recovery on the clone...

TobiSGD · 02-12-2012, 12:23 PM

Quote:

Originally Posted by Halobok

I dont want to beg by dev/sdb1 is my life

No backup for the data that is your life? That is sad, hope you learned the two lessons here:
1. Always have at least one recent backup of your important data.
2. Always double-check system-critical commands before executing them.

Having said that, Photorec (part of the Testdisk package) may save your life, but it depends on which format the files had. If it were images, documents, music or videos than chances are good, if it were a database or some very uncommon formats then you may have lost your data.

Halobok · 02-12-2012, 12:57 PM

Code:

Recovery of reformatted partition

If the partition has been reformatted to another file system (FAT32 formatted as NTFS or vice-versa),

    run TestDisk,
    select the hard disk and the partition type
    choose Advanced
    select the partition
    choose Type,
    enter the value corresponding to the previous filesystem
    choose Boot
    choose RebuildBS
    List
    If you can see your files, choose Write and confirm
    In Analyse, choose to rewrite the partition with the correct partition type.

I cannot find any Boot or RebuiltBS under Advanced??

Also i found this

Code:

 Previous
 superblock 32768, blocksize=4096 [sp]
 superblock 98304, blocksize=4096 [sp]
 superblock 163840, blocksize=4096 [sp]
 superblock 229376, blocksize=4096 [sp]
 superblock 294912, blocksize=4096 [sp]
 superblock 819200, blocksize=4096 [sp]
 superblock 884736, blocksize=4096 [sp]
 superblock 1605632, blocksize=4096 [sp]
 superblock 2654208, blocksize=4096 [sp]

 To repair the filesystem using alternate superblock, run
>fsck.ext4 -p -b superblock -B blocksize device

I ran fsck.ext4 /dev/sdb1 it asked lots of questions about fixing and created too much disk load, so I killed to from damaging files even more.

H_TeXMeX_H · 02-12-2012, 01:14 PM

You can repair the filesystem by running the command that it says. I recommend you do that. If you kill it ... you may kill it completely, if you know what I mean.

EDIT: You know, I just realized that there is no facepalm smiley ...

Halobok · 02-12-2012, 01:29 PM

I cannot undetstand whic command to run

its says fsck.ext4 -p -b superblock -B blocksize device ,
BS is same for all but it shows dozens of superblocks, which one should I use?

H_TeXMeX_H · 02-12-2012, 01:39 PM

Well, you can use any of them. I would use one of them in the middle.

TobiSGD · 02-12-2012, 03:22 PM

Before doing anything further, especially dealing with file-system tools, I strongly recommend to make a backup of that partition. The file-system tools can even make more of your data get lost. Use dd or any other partition cloning tool to make a full backup of that partition.

Halobok · 02-12-2012, 04:06 PM

OK my kids childhood photos was there and cd copies was lost.

Logical think was storing a image as many suggested, but i was shit out HDD space for such a dump and I neede some work files asap.

First photorec ripped whatever it could from drive, restoring lots of stuff.

than I ran fsck.ext4 -p -b superblock -B blocksize device , which acted weird and went a little bit crazy. Killed that with ctrl-c

than I said screw it and ran fsck.ext4 /dev/sdb1 , spammed 'Y' for questions. after completition mount failed. I used "-t ext4" to specify type. I ended up with a empty drive. ctrl+h revealed lost+found directory, which had everything I lost in there. I already had sha256 sums for my importent stuff, when I run a check an endless flow of "OK"s starteds. I can hardly even believe that all is back.

H_TeXMeX_H Thank you!!!!!
H_TeXMeX_H Thank you!!!!!
H_TeXMeX_H Thank you!!!!!
H_TeXMeX_H Thank you!!!!!
H_TeXMeX_H Thank you!!!!!
H_TeXMeX_H Thank you!!!!!
H_TeXMeX_H Thank you!!!!!

H_TeXMeX_H · 02-13-2012, 02:48 AM

Ok, but don't kill important commands like that. The command will do what it says. If you kill it, it may mess things up.