I have had the worst two days of my life today and yesterday.

I have a 120GB drive, of which 90~ GB is Fat32 and stores all of my really, really important data. Pictures of my kids, my entire music collection, all my business related stuff.

The rest is a copy of a /home from a distro of linux I ruined yesterday.

Well, today, I almost ruined the 90 gig partition. I was using parted to copy the aformentioned /home from an almost wrecked disk, and accidentally started to overwrite the FAT partition. NOw, this only happened for about 10 seconds, tops, before I had Cntrl+Alt+Deleted and killed the system. It wasn't my first choice, but Cntrl+C and X didn't do anything.

So I have a perfectly legitmate (incomplete) copy of my ext2 partition partially written over my FAT.

To my understanding, I have two things working in my favor here: For one, I am fairly sure that only about 10 GB of the partition was actually in use. I am hoping the really important stuff was in the middle or near the end. The second thing I have in my favor is that fdisk under linux recognized the partition as Fat32 Extended LBA. NOTHING else recognizes the drive as FAT, however. A concievable third thing that I have in my favor is that I have a decent partial backup, but lacking such notables as the irreplacable pictures of my daughter.

So here's what I've tried so far: I have tried using ptedit under DOS to set the filesystem type manually on the partition table. I have set is HEX 0B (Fat32X), HEX 0C (Fat32), and HEX (3hC) , which is a partition magic recovery marker. With the first two attempts, Partition magic sees only bare, unformatted disk space. With PQFlex (that's the third), I can see the size of the partition but still can't do much with it.

Now, due to the absolutely precious nature of this data, I am willing to take this drive to a professional to have it restored, but before I do that, I was hoping to get some input from the members of this forum, who are usually a wellspring of knowledge.

What if I use something like debugfs to dump the raw table to a disk someplace? I would have to do it in increments, because I don't have another disk this large. However, even doing this, how would I be able to actually recreate files?

What if I somehow adjust where the partition begins, and try to move past the area that was written? I am confident that only a small fraction of the drive was actually written before I killed the system.

Damn, sometimes life really throws these bad days at you. And all this on the heels of my decision to create a backup RAID....

first thing to do....make a backup of the entire disk.

since the very beginning of the partition is now a linux fs you will need to grab another hard drive with a fat partition and use the dd tool to make an exact copy of the other fat partition overwriting the linux/fat filesystem for about 5 seconds then kill it. the result should be a perfectly usable fat partition with minimal damage.

That's a terrific idea. Has anyone else ever tried this?

Specifically, I am worried that the first few megabytes of a FAT might contain information about how large the entire FAT is. In this case, I might be no better off with a FAT than an ext2.

However, if there is no indication of total size in the FAT's header, then I suppose it will work.

When I am all finished with the copying procedure, should I run a windows ScanDisk or Norton DD to fix the file table, or will that totally ruin the data?

i have done this technique 2 or 3 times...all of them weresuccessful. i believe it was ext3 or reiserfs though....shouldn't be a problem with fat, but i cant guarantee that as i've never tried it with fat. thats why the first step is critical if it does work, then once you have all of your data you need, i would format the partition and start fresh, after backing up what you recovered of course

So I guess I am not the only one that seems prone to hitting ENTER before really reading what they have just typed. I think it has something to do with being stressed out, working for 14 hours straight, etc. Sooner or later you are going to bang out a command a little too fast and sloppy and BAM!

actually, this might work better.

dd if=/dev/hdc1 of=/dev/hdb1 bs=1024

where hdc1 is the good fat partition and /dev/hdb1 is the bad fat partition. what this does is copies only the fat mbr making it fat without overwriting any data.

yep i hear ya...you're not alone...

but _we_ might be alone....i dont like reading when i'm stressed

Thanks a lot for that head's up. Seriously, if there is one big difference between windows and linux - it's the support you can get for free.

I'll let you know how that MBR update works out.

no problem...and yes, linux support beats any paid-for windows support ya plz let me know how it turned out. good luck

I think this would actually just read hdc into hdb1 1024 bytes at a time, wouldn't it?

nope, it reads up to 1024...actually, you want 512, sorry. the right way would be:

dd if=/dev/input of=/dev/output bs=512 count=1

/dev/input = good part
/dev/output = bad part

the count=1 is what you were thinking of i think.