how do i salvage/recover erased/unerased data on my hard drive?
how do i salvage unerased data on my hard drive?
i have a 120GB hard drive connected to my linux machine through a usb 2.0 because i'm trying to figure out if there is anything salvagable on it. i think i accidentally erased some stuff on there (repartitioned a portion of it on accident?) in windows and i hope i can save what is left. here is some output that might give a good status of things: ----------------------------------- Code:
[root@localhost nickleus]# /sbin/fdisk -l i think the 33.8GB is the portion i somehow repartioned/erased in winxp, so i think that is all erased, but how do i access/mount the rest? when i run: Code:
mount -t vfat /dev/sda /mnt /usbhdsda Code:
mount: wrong fs type, bad option, bad superblock on /dev/sda, too and get the same message. and what does sda1p1 mean? here's my output from dmesg: Code:
NTFS-fs error (device sda1): read_ntfs_boot_sector(): Primary boot Nick |
No backup?----sigh...
"Erasing" files (and re-partitioning) does not wipe out the actual bit patterns---it simply deletes the pointers. You may need to bring in a data recovery specialist. Since you did not have a hardware failure, the odds are on your side There are tools for scanning the raw device and--if you have the patience--you can attempt your own recovery. |
If you want to simply poke around and see what's there, start with dd
dd if=/dev/sda bs=512 count=N|hexdump -C >filename This puts N sectors of data in hex format into the file "filename". Look at man dd for other options---eg to start at an arbitrary sector instead of 0. If you know what you are looking for, you can use grep on the saved file. PROCEED WITH CAUTION---Something like dd will destroy your data very efficiently and with no warning |
linux tool for data recovery
any suggestions of linux tools for recovering data? i am a do-it-yourself type guy so i'll give it a whirl if somebody justs points me in the right direction.. thanks for your reply :)
|
pixellany, but that code bit you suggested is safe to run then?
|
Oooh oooh! I think I might be able to help with this one.
First of all, I noticed that you attempted to mount /dev/sda, that's no good, you need to mount a partition on /dev/sda, like /dev/sda1. However, the output from dmesg makes me think that's not going to be fruitful anyway. So, we are left with data recovery. So here's the concept, Knoppix (and other distros) have tools that will allow you to do a "raw dump" bit-for-bit of you entire partition, or parts of it and then scan the contents for old files that have lost their pointers (been deleted). I had to do it once to help the CFO retrieve a valuable email that was accidentally deleted from a Linux server. Worked awesome! But took all day. I can't walk you through it step-for-step, but here is what you should look in to: gpart- Finds lost partitions (not sure if this applies to you) unrm- Scans "free" space on your HD for files that have been deleted lazarus- Scans the results of unrm and splits the data up into separate files (slooow, but effective) A google search on those tools should get you what you need. May fortune shine upon you. |
bobmclaren, thanks a lot, i'll look up those things and give it a try =)
|
Quote:
Where dd can GET you is in doing raw device reads and write and getting the "of" and "if" mixed up. |
pixellany, thanks again for your quick reply :) i also just found a program called file scavenger for windows and am running it now. it seems to work great!
|
All times are GMT -5. The time now is 02:30 AM. |