Data Recovery after Linux Install
 

Greetings guys. In a moment of idiocy I've managed to install Linux Mint 13 onto the wrong hard drive (I've got 2 on my old PC, one of them already had Linux Mint 11 on it and I meant to replace it fully as I had no files I needed to keep. The other hard drive was formatted by Linux 11 to be used as a storage drive, and had a lot of my oldest family photos and pictures on it, IE The birth of my daughter, videos of bringing her home etc) Any suggestions on what kind of tools I might be able to use to recover any data that hasn't even over written too drastically yet? I'm very poor at the moment and can't afford to pay anyone else to attempt recover for me (Plus I HATE Taking my computers to other people to fix them, haven't done in once in the last 15 years and don't intend to again) Any help or suggestions would be great.

I discovered my mistake when I went to restart the computer for the first time after install and it listed Mint 13 and Mint 11 as options, I realzied then that I had selected the wrong drive for installation (Of course Mint 13 would suggest the nice mostly empty drive for an install :P)

Unless prohibitive size-wise the best first step would be to make a copy of the victimized partition to a file on another (external?) disk or partition. That way you can always start another recovery option w/o having to worry about the source. Boot a Live CD like KNOPPIX, don't mount the Mint 11 partition but first use 'testdisk' to recon the partition (it also allows you to recover files on a per file basis). After that run photorec on the victimized partition. Note for recovery you should have access to another (external?) disk or partition, empty and well over the size of the file system contents to be recovered.
(Maybe read some first: http://www.cgsecurity.org/wiki/PhotoRec)

I do have a 160 GB external hard drive I can use for this via USB. It doesn't have anything on it I don't care to lose other than one virtual machine I'm using for school ( I should easily be able to copy this to my windows Laptop for safe keeping)

Thanks for the prompt response! will get to work on this the second I get home from work and will post what happens here.

One question, is it possible when I installd Linux Mint 13 that it created it's own parition on that hard drive out of empty space that was on it, and left my picures and what not alone in it's own partion and I just over reacted and assumed it's all gone? I'm not very good with Linux yet I must admit I'm still in the earlier learning stages. Should I be able to use the Knoppix live CD to see all the paritions and what is on them?

PhotoRec is a fantastic program, thank you very much for the suggestion. I think I should be able to get back all the photos and videos with this. If not from the hard drive itself then from the external USB drive (I used that to hold the files in question while I formatted the hard drive for Linux Mint 11 in the fiirst place and only recently deleted them from it)

Possible but unlikely. Not the installers fault though as most of them ask you twice if you really, really, really want to nuke and destroy your disk.



Sure and you could see it also when booting a distribution from another partition (with say 'fdisk -l'). The reason I prefer a CDROM is that it tends to not auto mount everything including the kitchen sink, which minimizes the chance you'll do something else you shouldn't.


Less damage (less writing after deletion) may offer better chance at recovery. I just hope you've got enough empty space left somewhere to recover them files to...

I certainly don't blame the installer; it was my fault 100% I was in too much of a hurry to get it all installed and working. I should have taken more time making sure I was installing to the correct drive before I started.

I should probably try to recover from the external hard drive first, since it is probably the least damaged, using my laptop as a place to recover to. Then once I've gotten everything I can off of that, reformat it and use it to attempt to recover the hard drive as well just in case there are any photos or videos that are in better shape there than on the removable hard drive. Then I can compare the two recovers and just remove any duplicates and backup all my photos and movies to a fresh hard drive on the PC :P

I also want to visit my dad’s house and hide the archives on his PC just in case my home burns down God forbid, or more likely someone breaks in and steals my computers etc.

Question does PhotoRec go through file by file and ask me if I want to attempt to recover something or does it just attempt to recover the entire hard drive and dump the contents on another hard drive?

Sounds like you got a plan.


If you would store an external drive or tape there OK but trusting your backups to be safe on a working computer sounds like an unnecessary risk slash recipe for disaster to me.


As I wrote before, with Testdisk you can browse the victimized partition and do per file extraction, Photorec is for unattended recovery. Don't forget to tweak its extension list because you don't need it to waste time looking for say Word documents if the partition only holds images and movies.

This++; as always, very good advice from unSpawn.

Personally I would add that if they are that important/irreplaceable, do 2 separate backups on separate media, preferably store in different locations.

I've got knoppix on a live CD (using it now as a matter of fact) Having a bit of trouble finding the programs in question but will let you know how it goes :)

Okay I've run into a snag, I'm sure this is a simple problem but it's well beyond my current skill level of 0 :P

I've got Knoppix running as a live CD. I've found photorec (just typing it in from the command line) and the other program. The issue I'm having is that I can't mount a file system in order to serve as storage for the output. I attempt to mount the hard drive in the laptop but it fails and says it is busy. I also can't mount the external hard drive (just tried to see if it would work or not) remember at this point I'm trying to restore the photos and movies from my external hard drive. The Teskdisk program didn't allow me to undelete anything from it , or anything at all with it for that matter, but it did see that it was there at least.

photorec seems to be working fine but I can't mount the dang hard drive to serve as storage for the files it recovers. Any suggestions? The exact error message is
Error mounting: mount exited with exit code 1: helper failed with:
ntfs-3g-mount: mount failed: Device or resource busy

If you run 'fdisk -l' as root and with all disks attached and powered up you should get a listing where the first column contains the device name and the last one the file system like "Linux swap", "Linux", "FAT32" or "HPFS/NTFS".
With 'mount' or 'cat /proc/mounts' you can see which devide is mounted where. By the file system contents ('ls -al /path/to/mountpoint') you can see if KNOPPIX already mounted what you need access to.
For Linux partitions you can find out their mount point if their file system volume name has been set by running 'tune2fs -l' on the device, for example 'tune2fs -l /dev/sda1|grep e.na'.
Let's take a system with 2 SATA or USB (SCSI emulation) disks, one at /dev/sda and one at /dev/sdb. /dev/sda has two Linux Ext3 partitions /dev/sda1 and /dev/sda2 and /dev/sdb contains 2 partitions: /dev/sdb1 contains a FAT32 file system and /dev/sdb2 is NTFS-formatted.

- On the command line run 'fdisk -l' to ensure you know which partitions you have.
- next run 'mount' to see which partitions are mounted already.
- now create a mount point for all partitions by name: 'mkdir /mnt/sd{a,b}{1,2};'.
- mount /dev/sda1 as Ext 2 (you don't need journaling): 'mount /dev/sda1 -t ext2 /mnt/sda1 -o rw;'
- mount the FAT32 partition: 'mount /dev/sdb1 -t vfat /mnt/sdb1 -o rw;'
- mount the NTFS partition: 'ntfs-3g /dev/sdb2 /mnt/sdb2 -o rw;'.

got it working now thanks, I'll let you know how it goes ;P It's got according to this 17 hours or so left to run lol.

WOO! I've got back several pictures including one of my son's first smile ! Thank you guys SOOOO much! Also got hundreds of pornographic photos and movies (the hard drive used to belong to my sister in laws teenage son :P) Interesting what this program can find lol.

Good to hear.


Say thanks to the testdisk / photorec developers instead?
It's their tool. I only know how to read manual pages :-]

Once again UnSpawn saves the bacon of mere mortals.

Sure their tool saved my pictures but I would have never known about it unless you told me and helped me figure out how to use it. Reading manual pages is a skill all it's own sometimes.