Recover formatted EXT3 partition
 

OK, not a newbie, but never had to deal with this problem before:
Confused the letters on my dev and formatted 500GB drive with
I have not used the drive after that, so I expect all data to still be there.
I have 500GB empty on another drive so the only thing that comes to mind right now is to dump partition there as a file. But I'm not sure which tool to use for that either.

Anyone has a better idea on how to recover the data?

Any help appreciated except questions about backup. :-)
Thanks.

Assuming mkfs.vfat doesn't zero the whole disk (I have no idea how it works), most of the data will still exist on the disk, but anything which is in the place where the fat tables were written, and any other filesystem structural data will be damaged/lost. I could imagine any disk recovery tool getting quite confused because of the fat filesystem. I don't know of one which will 'reverse' this sort of operation.

If the data is really important, I would recommend making a backup of the disk image before running any sort of recovery tool. You can do this with the dd program, which is really useful for this sort of thing. Of course, you must have a device with enough free space on it to save the disk image.

mkfs.vfat does not zero out the drive -- it simply writes a blank FAT.

I do have the space, and I was going to use DD. To be honest, the data itself is less important than the file names. The drive was used primarily for archiving stuff that is most likely backed up, but I need to see what I lost before I do anything.

Can you suggest any tools? Price (<$100) is not really an issue. Please only suggest from experience, not from reviews.

Thanks.

The data are still there but the names are almost certainly lost. Names are stored in the blocks that you overwrote (partially) with FAT tables. If you are lucky, however, you may be able to recover a sparse block from the file system that used to be there.

Any suggestions as to how?

Try the testdisk app as suggested above. I have found it to be very efficient to recover deleted partitions but then I'm afraid you are looking at something more complex as your partition was also formatted to a different file system type. You may need to delete your partition (careful!) just to get it back to a "neutral" condition before testdisk can do its job but don't reformat to what used to be there as that will definitely overwrite any remaining back-up superblocks too. That would make the situation totally hopeless as for as recovering file names is concerned.

Here is some info on ext superblocks that you may find useful:
http://www.cgsecurity.org/wiki/Advan...kup_SuperBlock

Just being redundant, but use dd and back it up first!

Exactly what I was looking for. Running fsck right now. I'll reply with results.

Thanks!

Yeah, I'm working with a disk I DDed to. I'll left the original for now just in case.

OK, I'm copying my files right now from the recovered disk. So far, I don't think any files were lost, but as I said before, I'm not sure which files were there to begin with.

For anyone else in the same situation:
1. Use testdisk to find a backup superblock. (Very helpful suggestion)
2. Not sure if this was necessary, but I deleted partition tables with testdisk to get rid of vfat.
3. When you find the backup SB locations, run /sbin/fsck.ext3 -b [location] -B 4096 /dev/problem_device (you will also see this command with correct parameters in testdisk's log file)
3. You should now be able to mount the device. fsck will most likely delete the journal (did for me) so mount the partition as ext2. mount -t ext2 /dev/problem_device

I also found websites that said there is a way to specify which superblock mount will use (with -o sb=####,) but I wasn't able to mount the drive that way.

Again, thanks for all the help!