VectorLinux

The nuts and bolts => Technical General => Topic started by: M0E-lnx on July 14, 2010, 06:58:35 am

Title: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 06:58:35 am
I was doing some maintenance on a box @ home which serves as a file/print server. Just did a brand new install, so I wanted to clear up a bunch of junk I had left over and just save the data contained in one partition which is the one that holds the files served, the important data I want to keep goes in this partition, everything else that I can do without goes elsewhere.

So, I'm cleaning out the drives with gparted, and next thing I know, I have completely wiped out all partitions in my /dev/sdc. The important stuff was in /dev/sdc3

my /dev/sdc is a 250GB Sata drive, and after the dissaster, now holds a single ext4 partition. I'm not even sure what fs I used to have in /dev/sdc3 before the wipe, but I get the feeling it would be ext3, since I need to access this data from pre and post ext4 support linuxes.

So now, the question is... What are the chances of getting this data back?
is it at all possible?

I now face another problem... in case it is possible.
This is my biggest drive in the box. Other than this, I have /dev/sda and /dev/sdb both of which are 40GB each and my OS is running off /dev/sda1 on 20GB
meaning, I have a combined free space of about 60GB outside of /dev/sdc.

Help!
Title: Re: I screwed up... bad...
Post by: nightflier on July 14, 2010, 07:23:11 am
I once used testdisk to recover an entire drive that had gotten corrupted. I'd say make that your first stop:
http://www.cgsecurity.org/wiki/TestDisk

You would want to have a place to copy any recovered files to. If 60G is not enough, I see a shopping trip in your future.
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 07:33:15 am

You would want to have a place to copy any recovered files to. If 60G is not enough, I see a shopping trip in your future.

I was a fraid of this... Luckily, there is a frys right next door to where I work. Now, this is not the newest board around, would a sata3 drive work with old sata/sata2 connections? this sata thing is new to me.. lol
Title: Re: I screwed up... bad...
Post by: Joe1962 on July 14, 2010, 07:54:44 am
I have also succesfully used testdisk to recover removed partitions. It simply reestablished them and everything was back.
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 08:10:59 am
I have also succesfully used testdisk to recover removed partitions. It simply reestablished them and everything was back.

Did you have to store it to a separate drive too?

in my case, I have not only deleted the entire partition (all of them) but re-created a new ext4 partition covering the whole drive
Title: Re: I screwed up... bad...
Post by: Joe1962 on July 14, 2010, 08:23:58 am
I have also succesfully used testdisk to recover removed partitions. It simply reestablished them and everything was back.

Did you have to store it to a separate drive too?
No.

in my case, I have not only deleted the entire partition (all of them) but re-created a new ext4 partition covering the whole drive
Try it and see if it finds the previous partitions.
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 08:27:20 am
It doesn't see the preivous partitions. it only sees the new 250gb partition
Title: Re: I screwed up... bad...
Post by: Joe1962 on July 14, 2010, 08:31:14 am
Dang! I seem to recall a similar situation to yours and it worked. Maybe I didn't actually get to create a new partition? I can't remember 100%. Maybe you should try removing that partition and trying again? AFAICT, it can't make matters worse, can it?   ???
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 08:33:14 am
I read somewhere that every time you try the restore technique, you decrease your chances of getting the data back
Title: Re: I screwed up... bad...
Post by: retired1af on July 14, 2010, 09:07:34 am
Don't know why it would be that way as all you're doing is restoring the pointers contained in the file tables.
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 09:56:45 am
Just got back from lunch, and stopped by the local frys. Found a 500GB Sata drive for $44.00 and bought it just in case I need to do store the data somewhere else. By now, I've lost my remote connection to the box, so I wont be able to do anything to it until this evening. :(
Title: Re: I screwed up... bad...
Post by: MikeCindi on July 14, 2010, 10:35:19 am
Testdisk should allow a "deeper" search for partitions. In that search I believe (have to check the website) it actually searches the full disk vs. just the MFT. I don't know that you can do that remotely. I would expect it to find the data but if not photorec (by the same people) will find files that you've deleted long ago. I have used it on a few occasions and recovered data that I really didn't need to recover but it found the files anyway. What I would recommend most though is that you do not do any write operations to the disk until you are satisfied the partition is recoverable or you "give up" on it.
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 10:50:48 am
So, with MikeCindi's last comment, I guess I should leave the single partition I got there untouched, until the data is recovered or I decide to call it quits
Title: Re: I screwed up... bad...
Post by: retired1af on July 14, 2010, 10:53:25 am
Oh definitely! The more you fiddle with things and write information to the drive, the less likely it will be you are able to restore the drive to its former glory.
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 14, 2010, 10:54:44 am
Ok.. Thanks guys for the suggestions... I think I got enough information to put a plan together and go for it.

Will post back with results after the operation is done.

Title: Re: I screwed up... bad...
Post by: haywire on July 14, 2010, 06:28:06 pm
I'm kinda cooky about making backups, at least of my audio/video and graphics work...

So I never had many problems because I have things stored on 2 or 3 backup places.

I feel your pain though because before I was lazy and lost months of collected graphics and audio work... That truly sucked. I hope you are able to recover your data.

Steven
Title: Re: I screwed up... bad...
Post by: Andy Price on July 15, 2010, 12:26:28 am
Perhaps before you do anything else you should make an image your old drive. Since your new drive is 500 GB you should have plenty of room for the image plus any files you recover. If you mess things up you can re-image the old drive and try again. In the Windows world I would use Norton Ghost for this, in Linux I expect there is a simple command in the console that does the same thing - dd something?
Andy
Title: Re: I screwed up... bad...
Post by: nightflier on July 15, 2010, 05:23:59 am
A clone image is a great idea. You could use dd to make a bit for bit copy.
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 15, 2010, 06:45:51 am
A clone image is a great idea. You could use dd to make a bit for bit copy.

I'm not sure I'd have enough space for this, since a bit for bit copy would require 250GB of my new drive, and then any other restore attempts will fill the other 250GB, which I figure is not exactly 250GB, but a bit less than that in reality.

Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 18, 2010, 05:34:32 pm
Good news. Using testdisk, I was able to recover the drive to a previous stage and recover my data. Some of it is missing, but the most important stuff is back. Thanks everyone for your suggestions.

Title: Re: I screwed up... bad...
Post by: MikeCindi on July 18, 2010, 06:17:41 pm
I am very happy for you. I know the relief that such a recovery brings and testdisk has helped me many times.
Title: Re: I screwed up... bad...
Post by: Andy Price on July 18, 2010, 07:23:13 pm
That's great news. And now you have a spare 500 GB disk for your backups!
Andy
Title: Re: I screwed up... bad...
Post by: M0E-lnx on July 19, 2010, 05:56:27 am
Yeah.. Some of that stuff was important.. .I meant to delete the junk and keep the one partition with the imprtant stuff, but well, you all know the story.

Now i'm faced with another dilemma. As you all know, I just added a 500GB drive to this box, and had to reconfigure the hardware (that was fun), which leaves me with another annnoying issue.

Here is the list of the  hard drives in the box now. (output of fdisk -l |grep Disk)
Quote
Disk /dev/sda: 40.0 GB, 40020664320 bytes

Disk /dev/sdb: 250.1 GB, 250059350016 bytes

Disk /dev/sdd: 500.1 GB, 500107862016 bytes

Disk /dev/sdc: 128 MB, 128974848 bytes

The last entry in the list is a usb flash drive (128mb !!! )
Anyway, the problem with this output is that physically, there are (2) 40GB drives in this box, and only one of them is being detected.

I dont know what could cause this problem, but i'm not too worried about it since the undetected drive contains no important data, and as you can see, I do have  plenty of storage, so it remains at most a misterious annoyance in the back of my head, knowing that I have a 40gb drive that is not seen by the box.

Here are some more details about this box.
The board supports (4) sata ports and (1) IDE port
The IDE port is being used for (2) DVD drives (master & slave)
the 250gb drive and the 500gb drive are native sata drives.
The 2 40gb drives are old IDE drives I connected to the sata ports using a IDE to sata adaptor.

What this is means is that pretty much the board is filled up to capacity. and I have tried every possible configuration to get it to detect all drives, and I always end up with the same problem... one undetected drive.

Has anyone seen this before?