Short version: While attempting to install FC12, Anaconda took it upon itself to overwrite the partition on my backup disk. Now I need to figure out if there's a way to get at least some of my data back.

If there's a better place for this question, please let me know and I will happily move it.

Me: Using Linux since 1993, other Unixoid systems since 1986. I don't know everything--obviously!--but I'm not a newbie.

Long version:

Okay, so I bought this machine back in 2004 or so. It was a pretty decent machine back then, but it's showing its age now: 370Mb of RAM, 2 hard disks with 80Gb and 120Gb (I don't think the other specs are relevant, but just let me know if I'm wrong). In a fit of insanity, I decided to install Gentoo on it. Don't get me wrong: I love certain things about Gentoo. But the constant fiddling that's required, while it can be fun at first, gets old kinda quick.

So various and sundry things have been going wrong with it here and there (CD-ROM, sound card, etc ad infinitum), and, finally, it wouldn't even load X any more (almost certainly some final Gentoo update which broke something) and I said "screw it, I'll just put Fedora on it." This is what I use at work, and plus I have a good friend who has far more patience with admin stuff than I do and Fedora is what he knows. So, last night, I pick up an FC12 CD that I have lying around and decide to finally just reinstall the whole thing.

Now, I've been thinking about this for weeks. I went so far as to buy myself a Passport USB drive, 319Gb, and have been backing up up all my stuff very regularly to that drive. I go through one final cycle of backing up and verifying before I start the reinstall. So my drive is solid, and contains everything I could possibly need (and probably quite a bit of stuff I don't).

After booting into FC12, I used Palimpsest to explore the partitions on the existing hard disks. Not sure which was which, I mounted the Passport, where I have cleverly saved a copy of my fstab. Using this, I can see which of my partitions were /boot, /, /home, etc. Most of my personal data has been put into separate partitions so that I could reinstall without blowing away the data. I hope that I can do that there, but, if I can't, no matter: I have a backup. I find some bits of empty space and delete a few of the partitions and recreate them, consolidating the empty space. Still confident in my backup, of course.

So I run Anaconda. Nothing happens. Eventually, I figure out that it won't run the graphical interface because I don't have enough memory. Grumble grumble. Okay, I can use the text version, no biggie. It gets to the part about the disks. I tell it which hard disk to install itself onto. For some reason I think it's going to pop up and ask me about the existing partitions and whether I want to keep them or rewrite them (maybe that's a previous version of Anaconda? or a different installer altogether, who can remember). It does not. It babbles something at me about LVM (which I've personally never really used before), and then promptly locks up. Grumble grumble again. Obviously standard Fedora on a low-RAM machine like this is doomed to failure. I poke around on the Internet, and I eventually stumble on the Fedora "spins" and select FC13/LXDE. Hopefully this will have better luck.

Reboot with the new CD, take a look at my hard disks. It has completely overwritten the old partitions, replacing them with LVM partitions. Well, crap. That's annoying. But not a big deal: I have a backup. Take a look at the Passport. Its ext2 filesys has also been replaced with an LVM partition. Proceed to beat head against wall.

So, obviously what happened is, since I (foolishly) had the backup drive mounted at the time I ran Anaconda, it assumed I wanted it to take over that drive as well, and just formatted everything it could lay hands on as LVM. It certainly never asked me my opinion on the matter. But, fine, I shouldn't have had it mounted. I shouldn't have had it in the same room, I spose.

The question is, what do I do now? My first, panicked instinct, was to just set the partition type back to 83 (I believe LVM is 8E), which I did (using cfdisk). That might have made it worse; I dunno. But I'm pretty sure I haven't written anything else to the disk since then. I've tried testdisk (nothing useful; although it can seemingly find the underlying deleted partition, it won't actually do anything with it), and a bevvy of Windows Linux recovery programs (Stellar Phoenix, DiskInternals, Raise, and R-Linux), all of which were completely useless except for R-Linux, which scanned the disk for eight hours and was still going when I had to interrupt it (I may come back to that one, but so far it doesn't look too promising).

My primary problem is that I can't make an image of the disk because this little Passport is the biggest hard drive in the house. I would certainly feel better if I could image everything off it and then play with the image. But, of course, it doesn't matter that very little of that 319Gb was actually being used: I still need 319Gb worth of space to make an image. I ordered another (larger) Passport, which should be here Wed. Once I have that I believe I can do something like so:

Right? Then I can muck about with that image in some amount of safety.

Of course, I also have the original hard drives, which are not so large. testdisk can identify the original partitions on those too, but, again, won't actually do anything with them. If I could find something that would image just the partitions I care about, I could probably save those as well, but I don't have any other external hard drives with 120Gb of space free. Can I somehow take the info that testdisk is giving me about those original partitions and use dd to get only that part of the image?

Are there other recovery tools I haven't considered? I have a Windows (Win7) laptop, a Linux laptop (FC10, I think), although its power cord is flaky so it's not too reliable, a smaller Mac, a really old Windows box (XP on it, I think), and this formerly-Linux box, which I can only boot off CD's at this point.

There's nothing on this disk worth the 500 bux that professional data recovery would charge me, but it's worth a day or two of my life to try to get at least some of it back. Does anyone have any sort of ideas?

Sorry for the long post, but I was afraid that if I made it any shorter, people would complain that I hadn't included enough details. Hopefully there's something in there that will spark some inspiration in someone. TIA.

Hi, I hate it when that happens to me.

Couple of things,

Testdisk will require a partition larger or equal in size to the partition being recovered, Maybe you can make a new partition on the usb drive, large enough (use df to see disk-space)

Testdisk's Photorec may be helpful for certain (media) file types (by extension, .mp3, .txt)

dd_rhelp... Uses dd_rescue
http://freshmeat.net/projects/dd_rhelp/

I think you know the rest, detach usb drive, install OS, install tools

Recover usb hdd data. dd_rhelp is a bit more robust, as it checks from one end of the drive till it errors, then goes to the end of the drive and checks backwards. Add infinitum, until finished or interrupted. Creates a log file and search can be resumed...

Regards Glenn

1 members found this post helpful.

I'm sort of scared to do that, as it means writing further to the disk, which could do more damage. I'll probably wait until I have the new 500Gb disk and try to use that.

But I wonder if I'm missing something about the way that testdisk works. It finds the deleted partition(s) (after I do the "deeper search"), and tells me to select the one I want and hit enter. So I do that. Then it says "no partition found" or something like that ... what am I missing?

Yeah, I'm going to give that a shot at some point. My MP3s are also saved elsewhere, so I'm not worried about those, but I do have some pictures and videos I'd like to get back.

Ah, that's a good tip. I'll try that next.

Yeah, I was going to go ahead and do that, but then I worried that I'll be overwriting the original hard disks, and it may be possible to recover something from those. So I think I'm going to try to dd off images of those didks before I blow them away. Assuming I can find enough room to do so; any thoughts on how I can dd part of the drive? I believe testdisk is telling me what cylinders and/or sectors each particular partition is starting and ending at. Can I trust that, and then use it to tell dd somehow to save only the part of the drive I'm interested in? I'm just not sure how that whole thing would work. Worst case, I may have enough room on one external disk or another to save images of the whole original hard disks (80Gb and 120Gb).

Excellent. Thanx so much for the tips.

Hi,
cd to the recovery directory, the directory to where the files will be saved.

Run testdisk
Select Hdd
Select type (INTEL, for most of us p.c. users)
Go to Advanced
Select partition to recover
Select undelete

And wait...

No, but that's just my experience.

1 members found this post helpful.

Wait till you get a new hdd, or partition the usb-hdd, use df first to see how much data is on it, then make a second partition large enough to take it.

Now you will be able to recover the first partition to the second on the same hdd.

Bit of luck, you could get most of the data from all your drives on it, the(n) sort it later.

Naming recovered files is another hurdle to keep in mind.

you probably don't need LVM.
ref. https://secure.wikimedia.org/wikiped...er_%28Linux%29

1 members found this post helpful.

Okay, two problems I have with that:

1. The deleted partitions it finds when I do a "deeper search" don't appear when I do "Advanced".
2. I don't have an "Undelete" option.

Maybe I have an old version of testdisk ... it's 6.11.3. I got it from cgsecurity.org. Is there a newer version?

I do have a "Create Image" option ... I chose the LVM partition, which is where the partition(s) I want used to be, but it created a 2Gb image then said there was no more room on the disk and stopped, even though df tells me I have more than 120Gb left. This is a fat filesys on this particular external disk where I'm trying to save the image file, if that makes a difference.

Right now I'm just doing a dd to save the image. We'll see how that goes.

Well, all df knows about is the partition that's currently there, which is the LVM partition that I overwrote with the Linux partition type (i.e. 83), so df is basically quite confused ATM. Either way, the partition takes up the whole drive, so I don't really have room to make a second one.

Yeah, that's my plan ATM.

Indeed. Although, worse come to worst, there are only a few key files that I absolutely have to have. I'm hoping I can search through the image files and find those files. Not sure what the best way to find out exactly where in the image said files are, but I know some strings I can search for.

Yeah, I don't think I need it either. Fedora just seemed set on doing it. Once I get these hard disks imaged and saved, I'm going to see if I can bend Anaconda to my will. <eg>

Another useful program not mentioned here:
http://foremost.sourceforge.net/

It can't recover partitions, but it may be able to recover files a bit better ? Maybe.

1 members found this post helpful.

I got a bit lost in all that lot. Does the LVM mount - i.e. was a filesystem formatted in a LV ?. You say "df" sees it, but it's "confused" - show us command output. If it has been formatted more data is at risk.
Trying to create an (big) image on FAT (even FAT32) is a waste of time. Use ext[34] with a big blocksize.
As for testdisk not offering to restore partitions, it probably can't because you have a partition covering the entire disk. Delete that first. I'd reckon photorec would be a better option.

All care, no responsibility - as per my sig.

1 members found this post helpful.

Ah, yes, I ran across that one in my searching, but wasn't sure what it was good for. Thanx for the clarification!

Ummm ... maybe. Whatever Anaconda normally does, I suppose it did. (I know so little about LVM that I don't really have a good concept of what it does do, under normal circumstances.)

But, the bad part is that I did this:

So, no, it won't mount at this point.

I didn't mean to imply that df sees it ... I totally misspoke there. I should have said that mount was confused:

(And the error in /var/log/messages is the completely expected "can't find an ext2 filesystem on dev sdd.") (And I should clarify that I typed that in by hand, since I'm posting this on a different computer. JIC somebody sees a typo. <s>)

So, I can't mount it, so I can't df it (at least AFAIK).

Yeah, that's what I fear. LIS, it's whatever Anaconda does when it does its LVM thing ... does it go ahead and create a filesystem on it? If so, is it even something recognizable on its own? My impression from when I was booting up after the LVM creation, as well as booting up after I switched the partition type on the Passport drive, was that it was pulling all the LVM partitions together to make one huge file system ... so this one LVM partition on its own is, what, half a filesystem?

<sigh> Yeah, I figured that out last night. Then I tried dd | split, but it got into the middle of the second file and claimed it had an I/O error while reading. Now, this particular attempt is to image the original hard disks (in this case, the 120Gb one), not the Passport, and it's an older drive (probably wasn't new when I built the machine six(ish) years ago), but these are the drives I was planning to install my new Linux on, so that's disconcerting.

I know I should be using an ext2 fs, but this FAT32 drive is the only place in the house I can find with enough free space to save a 120Gb image. And the existing data on it is backups for the mother of my children, so I dare not reformat it.

So I think what I'm going to do is just go get myself some new hard drives and install Linux to them. At least that way I have a working Linux box, even if I don't have any data on it. I was hoping to avoid that (and the attendant "man, this computer fiasco of yours sure is getting expensive!"), but at this point, I'm starting to worry about trusting the old hard drives, and that's no way to start a fresh Linux install.

Again, slightly frightening to me to write anything to the disk at this point. Although, logically, the partition table is already screwed, so at least that part can't get any worse, right? So maybe I will try that.

Yeah, I definitely want to try that. I'm just hoping to get to the point where photorec can work on a saved image and not the actual drive.

No, I hear ya. The sad part is is that I did have a backup ... and I verified it, even. Maybe you should add something to your sig about keeping your backup in a vault somewhere where evil installation programs can't get to it .... <sigh>

For primary partitions, playing with the partitions themselves (as distinct from the data within them) is generally safe. The type indicator is generally ignored in day-to-day operations. There is one major exception - guess what ?. Yep, LVM.

LVM partitions have metadata in them because they are more akin to devices than partitions in non-LVM. Hence when you changed the type, mount goes looking for filesystem data and gets LVM metadata (hopefully you tried to mount a partition not the device above - that typo you mentioned ... )
The reason I suggested deleting the partition was so testdisk could hopefully make some progress - may not work though given that the start (at least) of any filesystem will be toast. Personally I wouldn't be doing anything till you have it imaged. You can do all the tests you like on that - if it gets damaged, just go back and remake the image.

1 members found this post helpful.

Oh, okay. Good.

Ah ... so maybe I haven't particularly made things worse by changing the type? I'm going to keep telling myself that anyway.

Yeah, that was just a typo. I definitely didn't try to mount the whole disk. Okay, good, so all that makes sense.

You are so right! Okay, so my new Passport came yesterday, and I've got a mostly-working Mandriva box now (had to give up on Fedora). (For those needing to know what "mostly-working" means, it means X is still flaky, but all command line goodness appears to be intact.)

Okay, so I'm currently using ddrescue (as opposed to dd_rescue) to recover the drive. With the big Passport mounted first, and the little Passport mounted second, I basically did the following commands (output not shown):

All seems to be proceeding. If I'm reading this output correctly, looks like we're up to 13Gb (out of 319Gb) rescued already ... much faster than using dd directly.

Once that's done, I should be able to run things like cfdisk small_passport.img and whatnont, right?

I'm definitely going to try photorec. But before I do that, there are a couple of smaller files that I really really need soon. What's a good option for scanning through a file and giving me a bit offset? I don't think fgrep can do that, can it?

Okay, ddrescue is all done! No errors. I did indeed try cfdisk small_passport.img, but it didn't care for it. fdisk didn't mind though. So I deleted the partition altogether.

Next, tried testdisk. It still finds the deleted ext2 partition underneath the LVM partition, after a deeper search, but when I do "Advanced" now it says there are no partitions to operate on and doesn't give me any options.

Used less as a crude way to find bits and bobs inside the image. I found several of my more important text files, so I know my data is in there, and most likely mostly intact.

Ran photorec on the image, which delivered unto me 104,697 unnamed files in 218 unnamed directories which, ANAICT, have no relation to my original dir structure. Mixed blessings there.

So, my filenames (and organizational structure) are in directories, right? And directories are just files, right? (Overriding Principle of Unix #3: everything is a file.) And my files appear to be in there. So, theoretically, my directories are in there too ... or at least some of them. And, if my directories are in there, I don't see why I can't (theoretically speaking, at least) recover a good deal of the original filesystem. Am I just not finding the right tool?

Any recommendations?

Directories are NOT recovered, only files, names are arbitrary.

Try to see a filesystem like as a mesh of sorts. The actual data is what fits in the holes in the mesh. Meta-data like blocks used by a file, file names and such are part of that structure. (Quick) (re-)formatting overlays the disk area with a new one, severing parts of any existing structure. Therefore these types of tools aren't able to "walk the tree" to 0) link data with file or directory names or 1) find all (2nd and 3rd level indirect) blocks that make up a file if the structure is gone. That's why file carvers like foremost, scalpel and photorec require file header and footer information to work with.

1 members found this post helpful.

No, I understand that the names aren't stored with the files. They're stored with the directories. But the directories are files (in ext2, at least; not so in DOS-based FSes like FAT32). If we can recover (some) files, then we should be able to recover (some) directories, that's all I'm thinking. And, with the directories come the names, and the structure ... am I right? Perhaps the root directory entry is near the beginning of the partition and was therefore overwritten, but then again I don't need that. I just need something to find any individual subdirectory entry it can and then pick up from there. By doing that a few times over, I believe the vast majority of the tree should be retrievable. At least I don't see why it wouldn't be.

Currently looking at SleuthKit/Autopsy and related tools to see what I can see from that angle.