Brother Nuke'd HD -- Need to Recover Data !!
 

Hi,

Yes, the subject gave it away. My brother has formatted the HD of my RedHat box.

I believe that formatting just marks blocks on the HD as 'empty', so I'm hoping there's a way to recover some of the data.

Can anyone recommend any software/reading to get this done?

Thanks.

Get hold of the GParted Live CD here choose the 0.3.3.7 ISO version rather than the latest. The new Fluxbox based GUI doesn't have enough tools. Burn it to a CD and then use that to boot your box. GParted will allow you to check the HD and fix the partition table. If you can't fix it, but you can access the data, then you will need soemthing like an Ubuntu Live CD with network support, so you back up to another machine on the same network. I did that the other day to extract the data from a trashed NT4 work station before doing a re-install. Boot the machine with the live CD, get it onto the network, then mount the drive from a second PC and copy off the data.

Thanks, sadiqdm.
I'll give this a try after work!

Just out of curiosity, if the disk was formatted, how would mounting it show the old data? In my opinion it will mount the new formatted filesystem, with nothing much visible inside, and not allow you to touch to the older content.
There are loads of rescue programs on the web, for both Windows and Linux (and for others too..but these two are the ones folks usually have), and some of them are even free of charge. Many are commercial and a lot of them have "free demo versions", but those demos usually have a limitation like they only recover 10 first found files, or even more commonly, show you what the program could recover, but won't do it before you buy the full version. I suggest you try one of those out. Not sure how effective they are, but if it's only formatted (and nothing is written on the disk after that -- do not mount it with write permissions, but read-only!) chances are good you'll get the things back.

If GParted (or alike) really could fix the table and bring back your data, I'd be both surprised and thankful. But this far I've always thought GPartEd (and alike) are merely "partition editors", not recovery software, so I would go after the recovery software myself. If the data is _really_ important, and not just warez, you may be willing to pay for a commercial recovery program (but in that case make sure it really is worth it). Or if it's really really really important, you might even want to take the disk to a recovery lab, though that will cost quite a lot of money..

Again, only mount the disk read-only, never read-write, to make sure the data doesn't get accidentally overwritten. You can use dd to make an exact image of the disk, just in case, but the image will be the size of the harddisk, so you'll need quite a lot of free HD space there. It works like this:
provided that your harddisk would be the primary IDE disk (hda) and you wanted the image file hd_image to be created under /home/username. You could then work on the copied image file, leaving the disk untouched, or at least have a "backup" in case the harddisk contents get wrecked. You may also use dd to put the image back to the disk (in that case just swap if= and of= arguments, so if is the image and of is the disk).

Didn't occur to me to ask before, but what's the command to try and fix the disk?
fsck?

Thanks for that b0uncer.

Any recommendations for a free recovery tool?

There seems to be a few on SourceForge, but nothing really stands out.

thanks.

fsck is a tool somewhat similar to the Microsoft ScanDisk, but I wouldn't go for that right now. Maybe dd an image of the disk to another disk and try it there; I think it just fixes broken partition tables, and since you said your disk is formatted, it's new partition table is probably just fine and fsck won't do a thing -- not anything good, at least.

I haven't used recovery software myself too much, this far I've (luckily) encountered only one disk that went downhill and it was beyond the skills of any recovery software I tried. Wasn't important enough for me to try those recovery labs, so I just let it be. Most if not all of the recovery programs can scan the disk and show what is found, before actually trying to recover anything, so you may try several of them to see if one works better than others. Or you can do a little web search for ratings or reviews of the tools..

EDIT: in my case the disk was a 512MB flash disk, which suffered a power surge, after which it seemed to be detected as a 8MB media that no machine could mount. I used dd to make an image out of it and loaded that into a hex editor that could show some ASCII data inside, and found out that for some reason the filesystem on the disk -- which couldn't be even formatted or written to anymore -- was just repeating a small section from the beginning of the original partition up to about 8MB. So..it was dead.

Testdisk and photorec.

Testdisk should be your first stop. It will scan the disk for lost partitions. If you're lucky, your brother only wiped out the partition table. That can usually be repaired within a matter of minutes, without copying out any data. The basic idea is that you simply infer the old partition table from the disk and have it rewritten to the start of the disk.

Photorec is indispensible when the situation is worse, i.e. when the disk was actually formatted. A Format will preserve most/all of your data but it overwrites their names so that they become invisible to the system. Photorec will scan the disk and try to recover as many of these anonymous data as possible. Make sure you have plenty of space to back up to: photorec is so thorough that it may also recover data that were deleted a long long time ago. It is not 100% failsafe, though. It does an excellent job recovering text files and images but it does not always perform well on multimedia files, especially the larger ones. There is a real risk that some music/movie files will either be beyond repair or cut op and reconstituted in the wrong way or simply ran together. Just bear in mind that you files will have lost their names and that you will have a lot of sorting and renaming to do.

have you tried

$ format brother

Sorry, ;-) , I know it doesn't help with recovering the drive. I just so wish I could have done that when I was a kid. Then again, that may have nothing to do with your sibling relationship.

On the serious side, the trick with dd and a hex editor is pretty cool. I'd never heard of that before. Certainly don't mess with anything like fsck until you've used a tool designed to look for and recover lost content. Using the wrong tool first can just make things worse. Jay73 sounds right on.

This may help. It has autopsy and sleuth kit.
http://www.efense.com/helix/