Recovering Last Data From Formatted Drive

kevind963 · 01-23-2014, 07:42 PM

Hello,

I have done something quite dumb and have lost some data I would like restored. To give some background, I created a new ZFS pool using zpool create

Code:

zpool create -f datastore raidz /dev/sdb /dev/sdc /dev/sdd

and did not realize that that would format the drives without warning. I have two of the drives that I would like to recover some data on. I have tried using testdisk to recover the data however I have not been successful.

When I run testdisk and analyze the drive I get the following result:

Code:

>P MS Data                     2046 3907028989 3907026944 [Hydra]

Hydra is the name of the partition that I am trying to recover. However, when I try to list files I get "no file found, filesystem my be damaged." If I run a deeper search I find the following

Code:

     Partition               Start        End    Size in sectors
   MS Data                     2046 3907028989 3907026944 [Hydra]
>  MS Data                     2048 3907028991 3907026944 [Hydra]

The drive is listed twice.

Does anyone have any suggestions on how to recover this data?

Thank you!

qlue · 01-24-2014, 09:07 AM

This depends on what type of data it is. The directory information may be corrupted in which case testdisk may be unable to help you. However, testdisk includes photorec, which can recover the individual files to a backup drive. The caveat is that the filenames are unknowable so photorec will use a series of numbers for file names.

This is fine for image files, video files and sound files. Software is generally unrecoverable in this way though and text files will be buried amongst thousands of scripts and configuration files you didn't even know were on the drive.

The backup drive you use to hold the recovered files must have more free space available than the total volume of the drive you're recovering or you risk running out of free space half way through.