Linux Disk Converted to MBR by Windows

Long story short, a drive was taken out of an HP Media Vault (which runs a linux based OS) and placed in a Win 7 machine. Windows apparently recognized the drive and prompted the user to convert it to an MBR - the user selected yes.

The drive has a lot of info on it which is still there, but can't be accessed by either Windows or Linux (Ubuntu) - can't mount the disk. Photorec will recover most of the files, but is there a way I can recover the files and structure?

Any ideas would be greatly appreciated.

In my experience, Photorec works best when used with another app called testdisk. You can read about and download it here.

Here's the introduction on there web page:

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

What does "sudo file -s /dev/<device>" say about the drive & any partitions?
Does a partition show up? What is the starting sector?

At one time, the default first sector of a partition was on sector 63. Now it's 2048. If the drive wasn't reformatted, maybe it was re-partitioned. Try attaching a loop device starting at sector 63 and see if a filesystem is detected.

sudo /sbin/losetup -fs /dev/<drive_device> -o $((63*512))
sudo file -s /dev/loop#

Where loop# is the loop device returned by the losetup command.

If that doesn't work, try an offset of 2048 (e.g. -o $((2048*512))
Using 512 byte sectors with all your tools like fdisk and df will prevent rounding errors.

Testdisk may be able to do this all for you, but gathering information on the state of the disk yourself may be helpful knowing what you are dealing with,.

Of course (in addition to the above) it's also possible the device wasn't partitioned at all, but was used as a full device. If such, the "conversion to MBR" would have wiped out (at least) a large chunk of the metadata that defined the usage.

I'd be heading back to that media vault to see how exactly it uses its disks.

There are no partitions and it was used as a full device. I am in the process of using Photorec to recover what I can, but unfortunately it doesn't recognize all file types and returns a lot of text files (seems to be parsing the unrecognized file types). I was hoping to be able to recover the structure as well as all of the files, but that is beginning to seem less likely.

Once upon a time (as a test) I deliberately re-formatted an ext3 partition as NTFS. As it was a test, this was a newly created (ext3) filesystem with a small number of newly created files - i.e. no updates, no fragmentation. Then I ran "mkfs.ext3 -S ..." just to see if it would work. Note the warnings in the manpage.
It did. In that very controlled environment.

In your situation I might be tempted to take a dd image of the drive and play as above on the copy. Nothing to lose if you have the spare capacity for the copy.

Thanks syg00,

I've been using Photorec and Diskgetor to recover as many files as possible, but I will definitely try your suggestion. Restoring the drive would be optimal! I'll post back when I get a chance to try it out (maybe later to day).

Okay, so in stopping to think about it... When I use photorec or testdisk it shows headings for linux swap, then ms data and ex2. Whether I try to restore from an NTFS or ex2, I get the same files (many of which are corrupted). Could there be something done with the swap file to recover the data or the drive in its entirety?

Note, I haven't tried syg00 option. I'm contemplating sending the drive to have it professonally recovered.