help me recover my data, please
 

Hello Linux gurus.I'm hoping someone can help me recover my data. Here is what happened:

A few months back I installed Ubuntu. I played around with it but I messed it up.I decided to try out another distro. No sweat, I thought, I'll just reformat the partition and start over.

I tried Qtparted in Knoppix to create a partition but the option was graeyed out so I went to Winwoes and used disk manager to erase my Linux partition. i decided i wanted a larger swap and tried to delete it but windows also deleted my partition with my documents. i guess because they both were in a extended partition.

I have a back up of my partition table but i can't get sfdisk to write it to disk. I don't know what i'm doing wrong, can someone help? i don' want to lose all my data when I think it's all still there.

Help!

What form is the backup of your partition table, and how was it done? If it is a simple file, what is the size of the file?

hi thanks for replying.the backup wasit was done using "sfdisk -d /dev/hda > backup" I guess it's a simple file. it says it's 432 B

Here are it's contents:
Warning: extended partition does not start at a cylinder boundary.
DOS and Linux will interpret the contents differently.
# partition table of /dev/hda
unit: sectors

/dev/hda1 : start= 63, size= 15406272, Id= 7, bootable
/dev/hda2 : start= 27276480, size=129019905, Id= f
/dev/hda3 : start= 0, size= 0, Id= 0
/dev/hda4 : start= 0, size= 0, Id= 0
/dev/hda5 : start= 27276543, size=129019842, Id= 7

i tried using cat backup | sfdisk -d /dev/hda like some websites sais but the partition table stay s the same.



I'm also trying gpart and here is what it gave me when using "gpart -i
/dev/hda"

Begin scan...
Possible partition(Windows NT/W2K FS), size(5514mb), offset(7522mb)

Accept this guess (y,n) : y

Possible partition(Linux swap), size(274mb), offset(13037mb)

Accept this guess (y,n) : y

Possible extended partition at offset(13318mb)

Accept this guess (y,n) : y

Possible partition(Windows NT/W2K FS), size(62997mb), offset(13318mb)

Accept this guess (y,n) : y


* Warning: short read near sector(156301299), 64512 bytes instead of 66048. Skipping...
End scan.

Checking partitions...
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Partition(Linux swap or Solaris/x86): primary
Partition(OS/2 HPFS, NTFS, QNX or Advanced UNIX): primary
Ok.

Guessed primary partition table:
Primary partition(1)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 5514mb #s(11293688) s(15406335-26700022)
chs: (1023/15/63)-(1023/15/63)d (15284/1/1)-(26488/1/56)r

Primary partition(2)
type: 130(0x82)(Linux swap or Solaris/x86)
size: 274mb #s(562144) s(26700156-27262299)
chs: (1023/15/63)-(1023/15/63)d (26488/4/1)-(27045/14/58)r

Primary partition(3)
type: 007(0x07)(OS/2 HPFS, NTFS, QNX or Advanced UNIX)
size: 62997mb #s(129018897) s(27276543-156295439)
chs: (1023/15/63)-(1023/15/63)d (27060/1/1)-(155054/15/63)r

Primary partition(4)
type: 000(0x00)(unused)
size: 0mb #s(0) s(0-0)
chs: (0/0/0)-(0/0/0)d (0/0/0)-(0/0/0)r

Any ideas?

If you have access to another pc with enough space on its hard drive to store the amount of data you lost. You count mount it as a slave drive and copy it over. Then when you fix it you could copy back. Kinda a pain, but I have done it a few times.
{edit}
Sorry you got that one in right before me. I am no good really when it comes to partitions, Thought you were just trying to recover a windows my docs and such. So please disregard.

lord-fu,

Knoppix gives me an error message but when gpart is done i'll try it again. i have no clue how to write the partition table back to the drive though. I tried sfdisk but it doesn't seem to change it, any tips or advice? I'm really knew at this so I'm really lost. I can see that gpart identifies something but it's not the same as my partition table right?

according to `man sfdisk`
so you should try
or

thanks uselpa. I'll give that i try when gpart stops doing its thing. I'm crossing my fingers.

One thing to consider is copying your data before you start messing around with file recovery. You can clone the drive using things like dd from a live CD---or you can clone it in another computer (cloning programs dont care what's on the disk--they just copy the bits)

Whatever you do, don't WRITE to the disk unless you are sure what you are doing.

thanks for the tip,pixellany. I'll go out and buy some dvd+r to back up because i don't have other hdd. I saw that fry's had a pack of fify for six bucks.Part of the problems is that i don't really know what i'm doing. i just assume my data is still there because i only lost the partition table (right??)but i don't know anything about linux so i'm just going through the motions. Like the gpart thing above? i don't know what it means but i think it's telling me that my partitions are there. anyway, i think knoppix has a disl cloner, righ?

1.well after backing up I tried uselpa's tip but this is what i got:
Any ideas of what i'm doing wrong? Anyone?

Don't complicate newbies
 

Have a look at this:
http://www.linuxquestions.org/questi...=data+recovery

I had the same problem with Windows.
My partitions were gone.
But then I remembered +/- of how my HD was partitioned.
It looked like this

HD with 80G

HDA1 Windows 5G VFAT
HDA2 Windows 35G
HDA5 Extended 40G
HDA6 SWP 256M
HDA7 / ReiserFS 5G
HDA8 /company 10G
HDA9 /songs the rest of HD

So I knew that my company's data was on a partition between 45G and 55G of the HD.
Then I made this:
New installation of LINUX
HDA1 Windows 5G
HDA5 Extended 75G
HDA6 SWP 256M
HDA7 / ReiserFS 5G
HDA8 /company ReiserFS 55G
HDA9 /recovery ReiserFS 15G

So all my old data should be in de "new" "/company" partition.
Log in as ROOT and install the program to (in this case HDA9 /recovery)
Please check the man page (man foremost) for details and your needs!!!!!!!

I executed this:
./foremost -v -s 50000000 -T -t jpg doc pdf -i /dev/hda8

The program started with search after block 50.000.000 created a folder with timestamp in /recovery and recovered JPGs PDFs
and DOCs

Good Luck!!!

Sören