Hardware :: Recover Data On Ext3 Partition On Ubuntu?
Apr 25, 2009
I wanted to upgrade from Intrepid to Jaunty. I opted for a format/reinstall as I figured upgrading usually sucks. To save my important data, I resized my partition (partition A), formatted the empty space with ext3 (now partition B), and moved the necessary files from partition A to partition B. Then I went through the install process and installed Jaunty on partition A, telling the installer to NOT format partition B. It gave a warning about the installer deleting system folders (var, usr, etc) but I figured it didn't apply. I was wrong.
So now partition B is "empty." I know it didn't format it, but I need to get those files off of there. I have created an image of partition B using ddrescue, but I don't know where to go from there. I tried using foremost, but it won't recover things like my virtual machines and completely nukes the original file structure I had. And I've tried mounting it (using sudo mount -t ext3 -o loop /home/user/recovery.img /mnt), but that doesn't seem to work. The mount command completes successfully, but nothing shows up in the folder I mounted it to.
A HP Netserver LP2000r, with original SCSI controller and HP NetRaid-2M controller, 3x 36GB Ultra3 HDD in RAID5, Debian (sarge/etch), has crashed after 992 days without reboot. From all that I can see, a hardware failure, most likely with the memory. The HP Diagnostic tools cannot find any problem, but everytime I boot into Knoppix, I get between 2minutes and 2 hours of runtime, and then either a kernel oops or just a complete and sudden halt.
Well, the box has earned its money. However, there is some data on the drives that I need to recover (yes, I have beaten myself up properly about not backing up that data, don't even go there !). There are three partitions: sda1 is /, sda2 is swap and sda3 is a LVM volume with 3 logical volumes on it. As far as I can tell, the hardware defect must have been creeping in and has made a total mess of the inodes in all these partitions.
After booting into Knoppix, I can restore the volumes using pvscan, vgscan, lvscan, vgcfgrestore and vgchange. If I try and mount them: mayhem. So I try and check them, using fsck.ext3. All sorts of interesting nonsense, such as a completely empty inode 11 (the first inode) and then obviously from there on all else is pointless. I tried using debugfs, but the information on what to do with it is somewhat spurious.
P.S.: Tomorrow I will go and get myself a 16GB Flash Drive and then hopefully I will be able to dump the partitions one by one onto that drive and transfer the images onto a different computer for analysis and data recovery.
I am facing a serious problem.I installed UBUNTU 10.04 and encrypted it during installation. I accidentally erased some of the necessary files from root folder. now the the OS is NOT booting.luckily i still have the encryption key i have some important documents in that drive (desktop folder).
PS: I have tried to run Live Ubuntu it shows the Root, but it does not enter any of the folder.
I have accidentally removed vmware virtual disk, my host operating system is RHEL5.2 with ext3 file system, i have used photorec, magicresue and foremost but still no luck to recover the vmdk file. i have seen in foremost configuration file that there are some predefined files (ex- doc, pdf, jpg, avi, zip, etc),
1. is there any way to add vmdk file extension on that configuration file?
2. if yes how can i do ?
3. by adding vmdk on configuration file, can i specifically use recover option for vmdk?
I am using CentOS 5.5.I suppose this is an oft repeated question. I accidentally deleted, using rm command, 2 wmv files. The files were in a single ext3 1Tb drive, with just 1 partition --- the ext3 one. Each file is 600 - 800mb. The 1Tb drive has only about 20Gb data.Immediately after deleting the files i unmounted the drive (/dev/sdc1). Thereafter i searched the the net and came to know of the recovery tools foremost and photorec. I have installed both of them. I am currently running both of them as root --- foremost is just showing a lot of * signs on the terminal and photorec has managed to find some txt and png files --- but no wmv.For foremost i used: /usr/sbin/foremost -t wmv -i /dev/sdc1For photorec i followed some instructions available on the web.
In the meantime, based on some post on the net i ran debugfs as root, then cd into the directory where the files were deleted. Then on typing ls -d i managed to get the inodes of the 2 deleted files and the names of the deleted files are also correct. The instructions on the net http://www.theavidcoder.com/?p=3 tell me to run fsstat and dls both of which i am unable to find in /bin, /usr/bin, /usr/sbin and /sbin. So i am unable to proceed further.
I usually repartition a disk by backing up, deleting the partitions, formatting them and repartition. I just did a 200 gig backup (so i am safe) and i want to join 2 (ext3) partition together, sdb1 (data4) and sdb5 (data5) into one big partition. Is there a way to do it without scraping the data in sdb5 (data5). It would save me from rewriting the data back to that new partition (200 gig is time consuming).
I installed windows 7 over an existing xp partition and windows 7 made a 100 mb partition as some sort of windows swap space thing. This basically made my ubuntu partition unreadable, even with gparted. How to recover this data?
Well i have an 20GB HDD (/dev/sdb) formated with ext4 and has very important files on it .All of sudden something went wrong and the 20GB partition has been lost . Now how do i have to recover that partition and primarily recover those files . Gparted shows no partition on it but unpartitioned space .
following problem. A friend phoned me in despair. Her Ubuntu didn't start any more - ASUS-Laptop switched on stops at a ramfs-prompt. I started Puppy-Linux from DVD-Drive. Worked fine. But puppy can't mount her /dev/sda1 partition either. At least you can see that the partition is still there. Fsck stops with an error. May be the initial problem is a sort of bad hardware by which bad bytes were written to the hard drive. Hard drive and/or memory could be replaced but not the data.
I need to mount a bsd/386 partition on my hard drive to recover data. I am running the latest CentOS 5.3, downloaded and installed in the last week.My searches have turned up a mount command, that does not work.
[root@new-host-2 ~]# mount -t ufs -o fstype=444bsd /dev/sda3 /mnt/bsd mount: unknown filesystem type 'ufs' [root@new-host-2 ~]# mount /dev/sda3 /mnt/bsd
So, is there a patch to get mount -t ufs working?is there a patch to get bsd/386 filesystem type? have not build a kernel before, so I would like to avoid that, but I will attempt it if I have no other options.
is there a way to recover data from a hd partition type fat32...cause ...cause right now it shows up as unallocated space..earlier i tried installing windows in a unused partition located just above this partition....i need to recover the data real soon...
I was putting the cover back on my Antec p180b, and I guess it got stuck and gave it a hard bump (pretty much broke the cover). As a result, one of my hard drives, a Seagate Barracuda ST3750640AS, got messed up or something. All the other hard drives are fine. It's in an LVM with another hard drive, so now I can't boot up into my computer. So I booted into the installation CD:
# find /dev/sd[a-c][1-3] /dev/sda1 /dev/sda2
This led me to believe the partition was messed up. So I ran cfdisk, and it said something about a missing partition table or something. Additionally, instead of showing the single partition on it, it displays, from my recollection, Pri*Log. To my knowledge, this is the only problem with the hard drive. So now I need to either somehow create or restore the partition table without overwriting the data. Or get a new hard drive, and some how recover the data (LVM, partitions, and all).
My main partition having all my data like movies, music, files,etc has become inaccessible. Its file system was NTFS. Due to some recent resizing using GParted, the partition as well as my WIndows 7 OS has become unbootable due to some errors. The data partition's file system has become unknown. I don't care much about the OS but I would like to recover my drive. I am trying to achieve this using Testdisk and Photorec but haven't met with much success so far. The main problem is I can see my partition and all my files through Testdisk but I am not able to copy them to another drive. When I try to copy the option I get is of copying them to the DVD and not to any other partition.
I used to have a 1TB external drive with lots of stuff on it. But after a reported drive failure during a F11 install the partition table seems to have been lost. (I think F11 toasted it)
Disk /dev/sdc: 1000.2 GB, 1000215724032 bytes 255 heads, 63 sectors/track, 121602 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes
The drive used to have xfs and a partition. Is there any way to rebuild the partition? Or is my 1TB of data gone forever? The drives seem to be fine now... I just want to get it up enough to either pull any data or just to get a file list. Most of the stuff on the drive was from somewhere else.(ie 300GB of NRN data for all of North America.
I have a 250 GB external disk, where there was store a hundred and something GB of data. Pictures, music, documents and TV-shows. It was FAT32. In an attemt to make an live USB drive with openSUSE, I did exactly what I shoulden't do: I mistook the external disk for the the USB drive. Now the external disk has a 700 mb linux partition, while 232.2 GB is unpartitioned. TestDisk from CGSecurity is looking to see if there is a lost partition table there, somewhere. Is there anything I can do? There was no formating, so the data is still there (except for those 650 mb that was overwritten). Is there any way to rebuild the old partition?
Output from "fdisk -l":
Disk /dev/sdc: 250.1 GB, 250059350016 bytes 64 heads, 32 sectors/track, 238475 cylinders Units = cylinders of 2048 * 512 = 1048576 bytes
I have an external 3.5" USB 250Gb HDD which is showing symptoms of hardware problems (repeated /var/log/messages errors of "reset high speed USB device using ehci_hcd"). This was originally plugged in to my NSLU2 running Debian Etch. I have just installed Ubuntu Desktop 9.10 to a spare Pentium-3M laptop and was hoping to copy the contents of this HDD to a fresh drive. However, I cannot mount it even read-only; mount -o ro /dev/sde3 /mnt/disk fails, and the /var/log/messages error is "recovery required on readonly filesystem", "write access unavailable, cannot proceed". I cannot understand why mounting a disk read-only should require write access. Following advice I googled elsewhere, I tried running mke2fs -n /dev/sde3 to try to list the alternative superblocks - but once again I got the error that the device was read-only. How can I go about accessing the data on this disk?
Original disk: XP NTFS primary Linux / ext4 logical Linux /home ext4 logical Win 7 NTFS logical NTFS data logical swap space NTFS recovery partition
I tried to install linux, as there was a problem with XP overwriting grub, I chose write grub to /dev/sda8 (which is where the linux install was appearing earlier).
I guess this borked the filesystem somehow. Now the NTFS data partition and the swap space are appearing as one free space. Well actually before that some linux live CDs (including gparted were seeing the entire drive as unpartitioned). I had to go into XP and delete the /ext4 partitions.
Is there any way for me to recover the NTFS data partition ?
recover deleted files using "debugfs" & "extundelete" by running:Code:sudo debugfs /dev/sda3 and find inode number of deleted file using "ls -d" command and then running:Code:sudo extundelete /dev/sda3 --restore-file <inode#>but when my desired file was in a deleted folder I can't find my desired file inode number using debugfs
Now am terribly frustrated because i reinstalled my linux installation(Ubuntu 8.04) after falling prey to an inode error. So i reinstalled stuff under my root partition under which i had some files which i obviously lost.I have tried recovering the files (mostly mp3 files) using photorec and the max file size i managed to recover was 4.0MB. the rest fall in the tune of 300kb.My question is, is there a way to make a full recovery of the above files seeing that they indeed can be recovered?