LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 03-29-2008, 05:59 PM   #1
designator
Member
 
Registered: Jun 2003
Location: California, USA
Distribution: OpenSUSE Tumbleweed
Posts: 214

Rep: Reputation: 37
Unhappy Recover formatted EXT3 partition


OK, not a newbie, but never had to deal with this problem before:
Confused the letters on my dev and formatted 500GB drive with
Code:
mkfs.vfat /dev/sdd1
I have not used the drive after that, so I expect all data to still be there.
I have 500GB empty on another drive so the only thing that comes to mind right now is to dump partition there as a file. But I'm not sure which tool to use for that either.

Anyone has a better idea on how to recover the data?

Any help appreciated except questions about backup. :-)
Thanks.
 
Old 03-29-2008, 06:10 PM   #2
matthewg42
Senior Member
 
Registered: Oct 2003
Location: UK
Distribution: Kubuntu 12.10 (using awesome wm though)
Posts: 3,530

Rep: Reputation: 63
Assuming mkfs.vfat doesn't zero the whole disk (I have no idea how it works), most of the data will still exist on the disk, but anything which is in the place where the fat tables were written, and any other filesystem structural data will be damaged/lost. I could imagine any disk recovery tool getting quite confused because of the fat filesystem. I don't know of one which will 'reverse' this sort of operation.

If the data is really important, I would recommend making a backup of the disk image before running any sort of recovery tool. You can do this with the dd program, which is really useful for this sort of thing. Of course, you must have a device with enough free space on it to save the disk image.

Last edited by matthewg42; 03-29-2008 at 06:11 PM. Reason: typo correction
 
Old 03-29-2008, 06:18 PM   #3
designator
Member
 
Registered: Jun 2003
Location: California, USA
Distribution: OpenSUSE Tumbleweed
Posts: 214

Original Poster
Rep: Reputation: 37
Quote:
Originally Posted by matthewg42 View Post
Assuming mkfs.vfat doesn't zero the whole disk (I have no idea how it works), most of the data will still exist on the disk, but anything which is in the place where the fat tables were written, and any other filesystem structural data will be damaged/lost. I could imagine any disk recovery tool getting quite confused because of the fat filesystem. I don't know of one which will 'reverse' this sort of operation.

If the data is really important, I would recommend making a backup of the disk image before running any sort of recovery tool. You can do this with the dd program, which is really useful for this sort of thing. Of course, you must have a device with enough free space on it to save the disk image.
mkfs.vfat does not zero out the drive -- it simply writes a blank FAT.

I do have the space, and I was going to use DD. To be honest, the data itself is less important than the file names. The drive was used primarily for archiving stuff that is most likely backed up, but I need to see what I lost before I do anything.

Can you suggest any tools? Price (<$100) is not really an issue. Please only suggest from experience, not from reviews.

Thanks.

Last edited by designator; 03-29-2008 at 06:19 PM. Reason: adding comment about mkfs.vfat
 
Old 03-29-2008, 07:12 PM   #4
Bruce Hill
HCL Maintainer
 
Registered: Jun 2003
Location: McCalla, AL, USA
Distribution: Fedora, Gentoo, Ubuntu (all servers at work are openSUSE)
Posts: 6,931

Rep: Reputation: 128Reputation: 128
http://www.cgsecurity.org/wiki/TestDisk
 
Old 03-29-2008, 07:17 PM   #5
jay73
LQ Guru
 
Registered: Nov 2006
Location: Belgium
Distribution: Ubuntu 11.04, Debian testing
Posts: 5,019

Rep: Reputation: 130Reputation: 130
Quote:
To be honest, the data itself is less important than the file names.
The data are still there but the names are almost certainly lost. Names are stored in the blocks that you overwrote (partially) with FAT tables. If you are lucky, however, you may be able to recover a sparse block from the file system that used to be there.

Last edited by jay73; 03-29-2008 at 07:20 PM.
 
Old 03-29-2008, 07:22 PM   #6
designator
Member
 
Registered: Jun 2003
Location: California, USA
Distribution: OpenSUSE Tumbleweed
Posts: 214

Original Poster
Rep: Reputation: 37
Quote:
Originally Posted by jay73 View Post
If you are lucky, however, you may be able to recover a sparse block from the file system that used to be there.
Any suggestions as to how?
 
Old 03-29-2008, 07:39 PM   #7
jay73
LQ Guru
 
Registered: Nov 2006
Location: Belgium
Distribution: Ubuntu 11.04, Debian testing
Posts: 5,019

Rep: Reputation: 130Reputation: 130
Try the testdisk app as suggested above. I have found it to be very efficient to recover deleted partitions but then I'm afraid you are looking at something more complex as your partition was also formatted to a different file system type. You may need to delete your partition (careful!) just to get it back to a "neutral" condition before testdisk can do its job but don't reformat to what used to be there as that will definitely overwrite any remaining back-up superblocks too. That would make the situation totally hopeless as for as recovering file names is concerned.

Here is some info on ext superblocks that you may find useful:
http://www.cgsecurity.org/wiki/Advan...kup_SuperBlock
 
Old 03-29-2008, 07:52 PM   #8
Bruce Hill
HCL Maintainer
 
Registered: Jun 2003
Location: McCalla, AL, USA
Distribution: Fedora, Gentoo, Ubuntu (all servers at work are openSUSE)
Posts: 6,931

Rep: Reputation: 128Reputation: 128
Just being redundant, but use dd and back it up first!
 
Old 03-29-2008, 08:08 PM   #9
designator
Member
 
Registered: Jun 2003
Location: California, USA
Distribution: OpenSUSE Tumbleweed
Posts: 214

Original Poster
Rep: Reputation: 37
Quote:
Originally Posted by Bruce Hill View Post
Exactly what I was looking for. Running fsck right now. I'll reply with results.

Thanks!
 
Old 03-29-2008, 08:12 PM   #10
designator
Member
 
Registered: Jun 2003
Location: California, USA
Distribution: OpenSUSE Tumbleweed
Posts: 214

Original Poster
Rep: Reputation: 37
Quote:
Originally Posted by Bruce Hill View Post
Just being redundant, but use dd and back it up first!
Yeah, I'm working with a disk I DDed to. I'll left the original for now just in case.
 
Old 03-29-2008, 09:30 PM   #11
designator
Member
 
Registered: Jun 2003
Location: California, USA
Distribution: OpenSUSE Tumbleweed
Posts: 214

Original Poster
Rep: Reputation: 37
OK, I'm copying my files right now from the recovered disk. So far, I don't think any files were lost, but as I said before, I'm not sure which files were there to begin with.

For anyone else in the same situation:
1. Use testdisk to find a backup superblock. (Very helpful suggestion)
2. Not sure if this was necessary, but I deleted partition tables with testdisk to get rid of vfat.
3. When you find the backup SB locations, run /sbin/fsck.ext3 -b [location] -B 4096 /dev/problem_device (you will also see this command with correct parameters in testdisk's log file)
3. You should now be able to mount the device. fsck will most likely delete the journal (did for me) so mount the partition as ext2. mount -t ext2 /dev/problem_device

I also found websites that said there is a way to specify which superblock mount will use (with -o sb=####,) but I wasn't able to mount the drive that way.

Again, thanks for all the help!

Last edited by designator; 03-29-2008 at 11:17 PM. Reason: spelling mistakes and block size change
 
  


Reply

Tags
ext3, format, recovery


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Recover formatted ext3 partition files mazzo Linux - General 9 07-02-2010 09:36 AM
Recovering a deleted and formatted over ext3 partition? Soniku Linux - General 4 04-02-2007 08:12 PM
Accidentally formatted a NTFS partition with ext3 kamran_pro Linux - Software 1 10-29-2006 03:31 AM
Accidentally Formatted NTFS Partition... Looking to Recover Data Adam A Flynn Linux - Software 5 08-13-2006 12:59 PM
recover fat partition formatted with ext3 by error mermoz Linux - Newbie 3 05-31-2005 07:55 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 03:50 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration