LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
 
Search this Thread
Old 06-19-2012, 10:50 PM   #1
Charles_N
LQ Newbie
 
Registered: Mar 2012
Posts: 2

Rep: Reputation: Disabled
LInux file system overwritten by ntfs


I recently accidently installed windows 7 ntfs over my ext4 file system. Is there a free utility to recover my ext4 files after they have been overwritten by ntfs. I need a program that will work from the Windows environment but it needs to recover my /home directory from Fedora 14.
 
Old 06-19-2012, 11:22 PM   #2
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732
Several generic points:

If you installed Windows on top of the old files, then trying to recover while running Windows will reduce the odds of recovery. In fact, you should not be running Windows at all---for anything.

Depending on the size and location of the old and new partitions, there's a chance of recovering at least some data----the point is that installing a filesystem does not necessarily wipe out old data.

I would NOT expect that you would recover any of the old filesystem structure---only individual files.

How to proceed:

1. Do not use that disk for anything---attempt the recovery only while running from a different disk, Live Linux CD, etc.

2. If the data is really valuable, then clone the disk before tryig anything.

3. the most commonly cited tools are photorec and testdisk---read up on them here: http://www.cgsecurity.org/wiki/Main_Page
 
Old 06-20-2012, 12:42 AM   #3
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,851

Rep: Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165
Quote:
Originally Posted by Charles_N View Post
I recently accidently installed windows 7 ntfs over my ext4 file system.
This could be read (at least) two different ways.
- if you actually installed the full Win7, you have overwritten a large portion of that ext4 filesystem. That portion is gone forever - no prospect of recovery. For the rest, try as above.
- if you merely re-formatted as NTFS (without actually writing any files), you may have a better chance. Again see the above, but in addition mkfs.ext4 has a "-S" (note that's a upper case ess) option. Be aware of the warnings in the manpage. Some time ago I tested this on ext3 after deliberately re-formatting as NTFS and it worked for my test-case.

I guess you never bothered with backups ?.
 
Old 06-20-2012, 12:55 AM   #4
szboardstretcher
Senior Member
 
Registered: Aug 2006
Location: Detroit, MI
Distribution: GNU/Linux systemd
Posts: 3,431
Blog Entries: 1

Rep: Reputation: 1144Reputation: 1144Reputation: 1144Reputation: 1144Reputation: 1144Reputation: 1144Reputation: 1144Reputation: 1144Reputation: 1144
Quote:
Originally Posted by pixellany View Post
In fact, you should not be running Windows at all---for anything.
I still laugh when I see good Windows insults.


Quote:
Originally Posted by pixellany View Post
1. Do not use that disk for anything---attempt the recovery only while running from a different disk, Live Linux CD, etc.
2. If the data is really valuable, then clone the disk before tryig anything.
3. the most commonly cited tools are photorec and testdisk---read up on them here: http://www.cgsecurity.org/wiki/Main_Page
This helps. However, to build on it, I would say, that if the data is very valuable, VERY, VERY, Valuable, Turn off the computer and take the drive out and take it to a data recovery lab. Expensive, but worth it.
 
Old 06-20-2012, 05:59 AM   #5
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732
[QUOTE=szboardstretcher;4707460]I still laugh when I see good Windows insults.

!!! I honestly did not mean it that way---but I see how it could be read. The point was that while running Window, files can be written to the disk
 
Old 06-20-2012, 06:08 AM   #6
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732
Quote:
- if you actually installed the full Win7, you have overwritten a large portion of that ext4 filesystem. That portion is gone forever - no prospect of recovery. For the rest,
I'd agree that the chances are slim---but maybe not zero. What I'm thinking is that a filesystem stores data where it finds space---until the partition is full, the old data is still intact. (my understanding is that the creation of a filesystem, while it does wipe out the old filesystem---does not necessariy wipe out all the data.)
 
Old 06-20-2012, 06:18 AM   #7
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,851

Rep: Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165Reputation: 1165
The bits that are overwritten are gone - the bits that aren't overwritten may be recoverable.
That's what I said.
 
Old 06-20-2012, 07:05 AM   #8
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732Reputation: 732
Quote:
Originally Posted by syg00 View Post
The bits that are overwritten are gone - the bits that aren't overwritten may be recoverable.
That's what I said.
Right......

I'm suddenly wondering what happens when a old file gets some new data written into the middle of it. In this case, photorec would still find the beginning of the file----but would it have any way of know that some of the data was not part of that new file?
 
Old 06-20-2012, 07:33 AM   #9
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Hanover, Germany
Distribution: Whatever fits the task best
Posts: 16,210
Blog Entries: 2

Rep: Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425Reputation: 4425
Quote:
Originally Posted by pixellany View Post
Right......

I'm suddenly wondering what happens when a old file gets some new data written into the middle of it. In this case, photorec would still find the beginning of the file----but would it have any way of know that some of the data was not part of that new file?
No, Photorec recognizes files only with using the commonly known headers/endings/whatever, but it doesn't care about the contents. This may end in Photorec "recovering" a file that is unusable because it is partially over-written or was fragmented.
 
Old 06-20-2012, 01:40 PM   #10
jefro
Guru
 
Registered: Mar 2008
Posts: 12,651

Rep: Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598Reputation: 1598
In a very true sense it could be recovered 100%. I doubt anyone here could do it unless they had access to some very specialized hardware. Companies charge like $1500 or more to recover disks. They have a special magnetic detection that tries to find out what the disk was along with software.

Can you do it? Kind of doubtful but if the data is untouched by reason of the same disk geometry then maybe. Undoing a partition and recreating it gets a bit more difficult but not much more.

Last edited by jefro; 06-20-2012 at 01:41 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to check NTFS file system in Linux ?? mynameisthomas Linux - Newbie 8 08-30-2012 04:59 PM
recover files from ext4 file system overwritten by new installation nsupathy Linux - General 1 07-03-2011 04:52 AM
NTFS File system support under RedHat Linux 5 anoopkjm Linux - General 1 05-09-2009 06:15 PM
Can We Mount NTFS Windows file System from linux gautam_iiith Linux - General 6 10-23-2003 06:47 PM
mounting ntfs file system on Redhat Linux 8.0 boy Linux - Hardware 2 12-02-2002 06:36 AM


All times are GMT -5. The time now is 02:50 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration