Hi,
Can anybody suggest any good data recovery software that runs under linux and can recover data from linux partitions as well as fat and ntfs partitions.

Cheers.

Searching LQ and looking at the bottom of this page in the "Similar Threads" will yield a ton of posts about 'photorec', its companion app 'testdisk' and much more. But maybe it would be best if you start by trying to explain what exactly happened. That makes it easier to post more specific information.

Hi,

'TestDisk' is a good utility to recover files or data when possible. Even if you formatted and did not write to the hdd then you possibly can recover some and possibly all of the data on the desired filesystem.

'TestDisk' is on 'SystemRescueCD', 'UBCD' and 'RIP' LiveCD to name a few.
'PhotoRec' is another recovery tool.

You can get other LiveCDs that may aid you from the 'Tools, Recovery, Diagnostic, Emergency' section of 'Slackware-Links'. More than just Slackware® links!

Hi,
Thanks for the replies. Basically, to cut a long story short, i accidentally, partially formatted a vfat partition to ntfs. I turned off the laptop just after i realised but by then the damage had been done. Although the drive is recognised (have set it up in a USB drive), it has no directory structure or anything. I have not written anything else to the drive since.

To get the drive recovered commercially is going to cost a lot of money and since i am a linux user i thought there must be a linux solution although i hadnt found one that seemed to work.

I will investigate "testdisk" - does this have the ability to resurect the original directory structure (aparently this is the best option) or take the files off in raw format (but then i have no idea how to get them back to the format they were in).

Cheers.

Searching LQ will yield some posts about accidentally formatted partitions. Basically formatting a filesystem overlays a mesh, a web-like structure, over disk contents (in contrast to zeroing out a partition which destroys filesystem contents). So everything not touched by the structure is more or less available. The problem is that entities are linked to their parent. For example a file is "linked" to it's parent (a directory) and a subdirectory is linked to its parent (a directory) as well. To confuse you even more, files which size exceeds a certain size will be broken up and "recorded" in different parts of the filesystem and those parts may be linked directly or indirectly. Removing the existing filesystem hierarchy and structure on disk (by formatting) destroys those links. Photorec (or foremost, scalpel, pyFLAG, et cetera) will try to determine the start and end of a file looking for distinct header and footer signatures (called carving). This is kind of a brute-force approach since not all files have distinct header and footer signatures and if there's files mixed in between they may be carved as part of the resultant file as well.

The best way to procede would be to boot a Live CD and make a bit-by-bit copy of the disk to another separate physical medium (removable USB storage?) before doing anything else with the machine. This way you always have a backup to fall back on might the need arise.

The first program i ever made in perl was for file recovery. It's not very good so I use foremost. You can recover specific filetypes with foremost such as all .doc files for example or a range of filetypes

Hi,

That's one of the basic reasons to have a LiveCD like 'UBCD' or 'SystemRecueCD' on hand whenever you need to boot. So you have utilities to perform recovery, fix or whatever on a 'unmounted filesystem.

I recommend that all users should download a Utility LiveCD before you have any kind of problem. Hopefully you will never need it in a emergency but use it to aid in maintenance of your system(s).

You too...

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

Google for additional guidance.