How do I recover old partition tables in linux?

PsychoFarmer · 01-04-2004, 11:37 AM

I recently accidently formatted and repartitioned over a fat32 drive, and now really really really need to recover the information on it. I tried using Norton unformat, but it doesn't work on anything non-dos.

Any suggestions on what program I should use to restore the partition table?

whansard · 01-04-2004, 12:16 PM

if you formatted it, you're mostly hosed.
if you used windows fdisk to create a partition on it and deleted the
partition with windows fdisk, it overwrote a bunch of stuff at the beginning
of the disk.

if you want to recover some stuff, your best bet is to use some professional
recovery tools. don't partition, format or anything else the drive.
you can use a disk editor or dd or cat to search the drive for certain text
as it is if you wish. you may be able to recover some unfragmented
files.

but for practical purposes, everything is already lost, unless you want to
spend big bucks for some pro data recovery place to restore it for you.

PsychoFarmer · 01-04-2004, 12:29 PM

the drive was repartioned during the fedora core 1 install... doubt that helps me much more though...

what recovery tools do you recommend to use?

moses · 01-04-2004, 01:25 PM

A search on this site will bring up some useful threads.
A google search for:

Code:

linux partition table recovery

returns the following page as a link in the first hit:
http://bmrc.berkeley.edu/people/chaffee/fat32.html
GNU's parted would probably be useful too.

There is also a free (as in beer; also only runs on a windows machine) recovery program here:
http://www.data-recovery-software.ne...Recovery.shtml
I've never used it so can't vouch for it (I found it using a google search: linux unformat).

The very first thing you should do is back up your entire disk using dd (a linux utility--if you want to back it up using some non-linux utility, I can't help with that). Apparently the r_linux software knows how to back up the disk so what comes next may not be useful to you if you go with their software. . .

To do this backup with dd, you need to have anywhere from 10-30% (depending on your usage of the disk) of the entire (damaged) disk capacity as free space available on another drive, as well as a linux system that has dd and gzip installed (could be as simple as an install CD/floppy).
For a 20 GB hard drive, you can do the following:

Code:

set 0 1950000 3900000 5850000 7800000 9750000 11700000 \
13650000 15600000 17550000 19500000; for i; do /bin/dd \
if=/dev/hdb bs=1024 count=1950000 skip=$i | gzip > \
/backup/backup_$i.gz; echo $i; done

This will take 11 ~1.95 GB chunks from the disk and compress them using gzip before writing to the backup disk. You want to use less than 2 GB because of file size limitations that may exist.
For a drive of a different size, you'll have to change the numbers so you cover the entire drive and don't try to skip past the end of the drive. /dev/hdb is the device name of the bad drive. bs=1024 is the block size and should be left alone.
/backup is the directory to which the chunks of the drive will be saved.

Once you've made a backup of the drive, you can try to fix it without worrying about completely losing any chance you had before you started trying to fix it. To recover the data back to the drive, you can do:

Code:

set 0 1950000 3900000 5850000 7800000 9750000 11700000 \
13650000 15600000 17550000 19500000; for i; do gzip -d -c \
/backup/backup_$i.gz | dd of=/dev/hdb bs=1024 \
count=1950000 skip=$i; echo $i; done

I don't do unformat or partition recovery, but the seaches suggested above will probably help you in finding information. . .

whansard · 01-04-2004, 01:42 PM

if the drive was just one big fat32 partition, you can recreate a big fat32
partition with linux's fdisk. linux's fdisk only overwrites the partition table.
the windows fdisk zero's out some data at the beginning of the drive, so
don't use that.
anyway, making one big fat32 partition, using the whole drive, will be like
"recovering" the partition, if that's the way it was before. you can then
have norton try to recover files on the drive after that.

like moses said, if you backup the whole drive with dd first, you can
try whatever you want to try, and just keep restoring it when you want
to try something else.

what all has been written to the drive? was it partitioned as one big
linux partition, and formatted, or was there more than one partition?
was anything written to the the formatted drive?

specifically what are you trying to recover? if you are hoping to get
everything back, give up now. if you just need some text or data files
back, you may be able to get them.

if it's worth it. (thousands of dollars) a profession recovery pplace has
equipment sensitive enough to recover data that has been overwritten
a few times.

ac1980 · 01-04-2004, 05:14 PM

Just to make you understand, here is the point: on fat32 files and dirs are written in blocks (tipically 4-32K). There is a table that, for each cluster, says if it is empty, if it's the last one of a file, or tells the number of the logically subsequent cluster. There are generally 2 or 3 copies of this table, one at the beginning of the partition, and this is almost surely gone, and one or two more immedately after (I think). Bad choice, since this is the place were all FS write their own data. If all the tables are gone, you can't simply know where a file begins or ends, or if it's fragmented. If you manage to recover that table, still you may get wrong data since some sectors of the disk have been overwritten by mke2fs.
If you actually INSTALLED fedora on top of your disk, you probably won't get any useful data out of it with software tools!
However if you only changed the partition table without actually creating new filesystems, you'll likely be able to recover a full working system via whansard's advice.

If you formatted but didn't install, try posting your partition table as it is now, we can tell you if it's worth keeping trying...

best wishes
Alessandro