Hi,

I have a Mandriva 2010 box that inadvertently has the first 64MB overwritten with garbage. Is there any way to recover files from the HDD, and if so, how?

Thanks.

The first thing I'd try is booting to a Live CD and having a look round. If only the first 64MB were overwritten and the MBR is still okay, the remainder might still be visible.

I'd likely use Knoppix for this, but pretty much any Live CD should work at least to take a look. You may even be able to copy the files that concern you to removable media or across a network.

If your installation media includes the option of booting, it could well do the job.

If the MBR is hosed, you can reformat it with a dd command. I know that command works; I've used it.

Greetingz!

Ah, I've made that mistake with the 'dd' command before. Can't Control-C out of it fast enough.
My first suggestion would be your backups, aside from that you'll have to tell us what kind of filesystem it is (do a 'mount -n' and grep for the file).

Once we know what filesystem it is (ext2, ext3, ext4, reiserfs, reiser4, and so forth). Then maybe we can find some tools.

Hi,

Thanks for the quick replies.

The MBR is hosed. The first 64MB of the device(/dev/sda) was dd'ed to with garbage.

I'm not exactly sure what the filesystem is but I strongly believe it's ext4 since I seem to remember that's the default filesystem for Mandriva 2010.

Thanks again!

Anyone?

Testdisk and Photorec can help you get back files which were not overwritten, as can Foremost. I have a vague idea of how these programs work, but can't offer any advice in their use.

The basic idea is that even though the filesystem metadata associated with the files has been destroyed, the data itself is still recorded on the media. By searching the disk for specific byte sequences, and making some assumptions to fill in the gaps left by the missing metadata, the files can be copied to a healthy volume. I have used such techniques to manually recover data in the past, and it is not easy.

As for data which was actually overwritten by dd there is little hope of ever getting it back. I have pondered this myself, and there are rumors that such technology exists, but I don't know of any way.

Assuming you can recover the files you need, the corrupted volume can then be reformatted and put back in use.

And that's probably as helpful as I can be for now. Hope someone more experienced can aid you. I wish you the best.

You will need to identify which files or directories that you really really want to spend significant time recovering. This is expensive.
Most of the files are easily replaced by reinstalling, and downloading.
First see the Linux HOW-TO on recovering deleted files in an ext2 filesystem.

What you CANNOT do is re-init the filesystem on the clobbered drive, because that will rewrite the filesystem info blocks over the whole drive, wiping all directories (VERY BAD).
On ext2 drives those info blocks are scattered over the whole drive, so most of them are
still there. The problem is that the only way to access them is from the master table
which is at set positions from the start of the partition (but it differs based upon the size of the partition).
There is a backup master table kept at higher addresses in ext2 systems also, but I cannot tell you if your filesystem maintains it.
Need to read the Linux kernel docs to find that out.

Do you have any record of the partitions.
Without that, it is going to be difficult to know where to set partitions.
It is critical to get the partitions start sectors restored as they were, or nothing is going to work.
For Linux there should be a main partition and a swap partition at least.
I am going to guess that you do not know the partition info.
Next best thing is to try to remember how big the partitions were (in MB), then
you can at least get a close guess, and try a few variations.
You will have to remember if it is ext2, ext3, or ext4.
You will need to use fdisk to make a new partition table.
Not knowing the partition start sectors, you are going to have to guess.
Try one setting, then see if that partition is recognized, etc.
This could take days of guessing at partitions.
It is OK to rewrite the partition table, and see if any partitions will mount(using bootable CDROM), as that will not do any more damage.

Once you got the partitions, you download one of the tools to recover deleted files on ext2 systems.
It is a bit cryptic to use, and there is probably a better one by now.
It will create a bunch of files, which are mostly individual sectors.
The files will be wrong, missing sections, and some combined from several original files.
The next step is to use various editors to put the data from these files back the way
they were in the originals. This can be done for text files, but binaries are pretty much
impossible.

The last time I did this, it mostly got done by hand, and I only need to recover about 20 files in a directory. It still took a day and half. Mostly reading docs before touching anything. Add a couple hours to straighten out the recovered files.
There may be a few better tools for data recovery now, but I would not expect much.

If you had another partition above the one that got clobbered, then you could make it bootable, install Linux to it, and use that to investigate the disk.
Now days it is easier to use a bootable CDROM of any handy Linux.
Another plan is to put in a different disk, and install Linux to it. Then run that Linux to work on this clobbered disk.

I could be easier to type it all back in by hand than try to get it off such a disk.
Did that once too.

Find another similar machine with the same setup. Then dd the first 64M of that drive to a thumb drive file, then dd that file to the first 64M of your clobbered drive. That cant hurt things any worse than they are, but could at least get you a valid MBR and valid filesystem info block and master info. Make absolutely sure you dd in the right direction, or you will clobber that drive too.

You could even try by getting another drive of similar size. Then setup the MBR as if it was the size of the drive that got clobbered. Then install all your filesystems.
If you can guess the partition size right, then the filesystem info blocks will be at the same positions as on the clobbered drive.
The dd the first 64M of that new drive to the clobbered drive to get the missing MBR and filesystem info blocks.

If you can ever mount it then the rest is easy. Copy everything you wanted to CDROM or some other media. BACK IT UP using tar files, or the backup program of your choice. Even backup stuff you think you don't need, like all of /etc, because later you will erase the whole drive. Any recovered filesystem is unstable and cannot be used for more than emergency reading of files. Then rebuild the disk filesystems, reinit them all. Then reinstall Linux, and restore your backup files.

I have two 250 MB partitions at the low end of the disk, then comes the main Linux partitions. There are always two bootable Linux partitions on my drive at all times.

Like others have said, here's what I would do:

1) Have a disk to recover files to, other than the disk you are recovering from, to prevent overwriting any files.
2) Boot a live CD, for example:
http://www.sysresccd.org/Main_Page
3) Use testdisk or foremost to carve files out of the source disk and store them on another disk.

An example command for foremost:
For -k use the number of MB of RAM, or a bit less. Here you have at least 500MB RAM.

2 members found this post helpful.