Ubuntu :: 10GB Of Data Overwritten In NTFS Partition - Hard Disk Safe
Jul 22, 2011
So the first 10Gb of a 450GB NTFS partition have just accidently been written over with an Ext4 filesystem that spans the entire partition instead. all foolishness asside, what can be repaired. Now I know Ext4 likes to jot bits of meta-data down (inodes blocks) along the way, and this can be about 5% of drive capacity, that said, there's alot of small text files and stuff, coe files so forth that can surely be recovered
I've looked into magicrescue and testdisk, but they fall into the only two groups to exist:
1) Filesystem independent, that is search almost like a patern - well exactly like a pattern match, to find the header and footer of files.
2) Filesystem recovery tools, like, damaged bootsector, so forth
I need one, that will be able to extract files, Iunderstand this will be a hard task, but.... text files; surely that'll be easy, anyway. This is my backup drive, they''re both WD you see, anyway. This is important, given the coding is ASCII surely.
Just ran into an uncomfortable problem. I usually never save any documents on my machine, and keep all my stuff on an external USB hard disk. (an 80GB TrekStor DS microdisk q.u) Well yesterday this disk just would not mount. Read through related posts but nothing seemed to work. Even tried it on a Windows machine.
Tried TestDisk utility. Found nothing wrong with the drive, but still could not repair the MBR.log code...
Palimpsest Utility recognized the drive, but just will not let me do anything with it except format it.
How can i repair the partitions and MBR without losing all my data?
While attempting to install FC12, Anaconda took it upon itself to overwrite the partition on my backup disk. Now I need to figure out if there's a way to get at least some of my data back. If there's a better place for this question, please let me know and I will happily move it. Using Linux since 1993, other Unixoid systems since 1986. I bought this machine back in 2004 or so. It was a pretty decent machine back then, but it's showing its age now: 370Mb of RAM, 2 hard disks with 80Gb and 120Gb (I don't think the other specs are relevant, but just let me know if I'm wrong). In a fit of insanity, I decided to install Gentoo on it. Don't get me wrong: I love certain things about Gentoo. But the constant fiddling that's required, while it can be fun at first, gets old kinda quick.
So various and sundry things have been going wrong with it here and there (CD-ROM, sound card, etc ad infinitum), and, finally, it wouldn't even load X any more (almost certainly some final Gentoo update which broke something) and I said "screw it, I'll just put Fedora on it." This is what I use at work, and plus I have a good friend who has far more patience with admin stuff than I do and Fedora is what he knows. So, last night, I pick up an FC12 CD that I have lying around and decide to finally just reinstall the whole thing. I went so far as to buy myself a Passport USB drive, 319Gb, and have been backing up up all my stuff very regularly to that drive. I go through one final cycle of backing up and verifying before I start the reinstall.
So my drive is solid, and contains everything I could possibly need (and probably quite a bit of stuff I don't). After booting into FC12, I used Palimpsest to explore the partitions on the existing hard disks. Not sure which was which, I mounted the Passport, where I have cleverly saved a copy of my fstab. Using this, I can see which of my partitions were /boot, /, /home, etc. Most of my personal data has been put into separate partitions so that I could reinstall without blowing away the data. I hope that I can do that there, but, if I can't, no matter: I have a backup. I find some bits of empty space and delete a few of the partitions and recreate them, consolidating the empty space. Still confident in my backup, of course.
So I run Anaconda. Nothing happens. Eventually, I figure out that it won't run the graphical interface because I don't have enough memory. I can use the text version, no biggie. It gets to the part about the disks. I tell it which hard disk to install itself onto. For some reason I think it's going to pop up and ask me about the existing partitions and whether I want to keep them or rewrite them (maybe that's a previous version of Anaconda? or a different installer altogether, who can remember). It does not. It babbles something at me about LVM (which I've personally never really used before), and then promptly locks up. Obviously standard Fedora on a low-RAM machine like this is doomed to failure.
I poke around on the Internet, and I eventually stumble on the Fedora "spins" and select FC13/LXDE. Hopefully this will have better luck. Reboot with the new CD, take a look at my hard disks. It has completely overwritten the old partitions, replacing them with LVM partitions. But not a big deal: I have a backup. Take a look at the Passport. Its ext2 filesys has also been replaced with an LVM partition. Proceed to beat head against wall. So, obviously what happened is, since I (foolishly) had the backup drive mounted at the time I ran Anaconda, it assumed I wanted it to take over that drive as well, and just formatted everything it could lay hands on as LVM. It certainly never asked me my opinion on the matter.
But, fine, I shouldn't have had it mounted. The question is, what do I do now? My first, panicked instinct, was to just set the partition type back to 83 (I believe LVM is 8E), which I did (using cfdisk). That might have made it worse; I dunno. But I'm pretty sure I haven't written anything else to the disk since then. I've tried testdisk (nothing useful; although it can seemingly find the underlying deleted partition, it won't actually do anything with it), and a bevvy of Windows Linux recovery programs (Stellar Phoenix, DiskInternals, Raise, and R-Linux), all of which were completely useless except for R-Linux, which scanned the disk for eight hours and was still going when I had to interrupt it (I may come back to that one, but so far it doesn't look too promising).
My primary problem is that I can't make an image of the disk because this little Passport is the biggest hard drive in the house. I would certainly feel better if I could image everything off it and then play with the image. But, of course, it doesn't matter that very little of that 319Gb was actually being used: I still need 319Gb worth of space to make an image. I ordered another (larger) Passport, which should be here Wed. Once I have that I believe I can do something like so: Code: dd ifs=/dev/sdX ofs=/mnt/bigpassport/smallpassport.img bs=512 Right? Then I can muck about with that image in some amount of safety.
Of course, I also have the original hard drives, which are not so large. testdisk can identify the original partitions on those too, but, again, won't actually do anything with them. If I could find something that would image just the partitions I care about, I could probably save those as well, but I don't have any other external hard drives with 120Gb of space free. Can I somehow take the info that testdisk is giving me about those original partitions and use dd to get only that part of the image? Are there other recovery tools I haven't considered? I have a Windows (Win7) laptop, a Linux laptop (FC10, I think), although its power cord is flaky so it's not too reliable, a smaller Mac, a really old Windows box (XP on it, I think), and this formerly-Linux box, which I can only boot off CD's at this point. There's nothing on this disk worth the 500 bux that professional data recovery would charge me, but it's worth a day or two of my life to try to get at least some of it back.
My primary drive is 250GB and has the root, home and var (I'd read it's good to put var on a separate partition for MythTV which I'm planning on doing) on separate partitions. I have a second 1TB drive that I'll be using to backup the 250GB drive and also host less critical data. I've created two partitions on this drive, one 250GB and the other covering the rest of the drive. I'd like to move the Videos directory out of Home on the 250GB onto the 1TB drive but can't find a definitive way of doing this. Should I just follow this guide for moving the home folder to a new partition? Next question is when performing a backup of the 250GB drive how do I make sure it's going to the 250GB partition on the 1TB drive? Can the different partitions be mounted separately?
Long story short, my Windows had a fatal crash the other day and since I couldn't find the installation disk, I burned the Ubuntu 9.10 disk image to a CD at a friend's place and installed it on one partition of the hard drive. The other partition contained tons of Windows programs and documents in an NTFS system. Ubuntu is cool and all, but when I finally found the Windows disk, I wanted to reinstall it for dual-booting, to use some programs that don't run well in Wine.
To keep some documents safe and not waste any CDs, I moved them over to the Ubuntu partition before installing Windows. As experienced ubuntuists know, the slightly clumsy Windows installer erases GRUB in the process, and it's recommended to install Windows first. So, now I ended up with a working Windows partition and an Ubuntu partition with all of the stored data, which I can access via guest status with the burned CD.
Here's the catch though - as a guest and without Linux properly installed I can't move anything I moved to the Linux partition from the Windows partition back anymore. All the folders have a little X on their top corner. I'd be glad to reinstall Ubuntu now, but I must know how to keep all that tranferred data safe. Can I keep it there during the reinstallation? Should I install Wubi on Windows and access the stuff through it?
I've initialize a virtual disk and deleted the partition table didn't notice that i've done that to the wrong one, data still on the physical hard disks but....how I'll get my data back safe without losing it?
I am trying to access data that is on a Raid 5 array in Ubuntu... There are 4 installed disks (250gig disks) - 3 of which are setup as a Raid 5 array (the 4th is active but unused). These show up as one large drive (498gig). I have had an issue with the drive where it is no longer allowing Windows to boot - I receive a disk read error on boot (so the OS does not load, obviously!) - what happened was basically I unplugged then replugged in one of the disks which affected the array... I physically reconnected everything as it was, I then had to 'reactivate' the disk in the Raid BIOS... at that point the array seemed OK, was the right size, etc (and was listed as "Optimal" in the Raid BIOS) however, the problem with the disk read error persists.
I have started the machine using Ubuntu v9.10 from a CD (non-destructive mode) and it shows a disk of the right size (ie: on the desktop and in Nautilus it says "498gig Filesystem" ). However, in Nautilus, the disk appears empty with no folders or files on it (even with hidden files shown).... If I view 'Information" for the disk it shows 67gig used space and 399gig free space (which is correct). Also, if I view the disk in Gparted, it shows a disk with about 67gig of used space and 399 free space on a 464gig disk (with 8gig unallocated). One more thing.... when I try the command 'sudo dmraid -tay' it says that there is no raid disk (there are in fact, no drives plugged into IDE or SATA slots - all disk are plugged into the RAID controller card). Anyway, at this stage, I just want to copy the data to a single hard disk if possible and move on.
This forum might not be the best place for this question, but some people here are pretty knowledgeable and may have more insight than I do about this. Anyways, I'm thinking about expanding an NTFS (Windows 7) partition on my desktop computer into unallocated space. I know that there is a risk when shrinking a NTFS partition due to fragmentation but are there any risks of data loss from expanding a NTFS partition? My common sense tells me there isn't a risk but I want to be 100% sure I won't lose any files.
When i work in Ubuntu on a dual boot system with a shared NTFS data-partition where Windows is hibernated, and then reboot and continue working in Windows from the hibernated sesion, strange things happen. Files disappear, files that i worked on suddenly have the content of another file.
My main partition having all my data like movies, music, files,etc has become inaccessible. Its file system was NTFS. Due to some recent resizing using GParted, the partition as well as my WIndows 7 OS has become unbootable due to some errors. The data partition's file system has become unknown. I don't care much about the OS but I would like to recover my drive. I am trying to achieve this using Testdisk and Photorec but haven't met with much success so far. The main problem is I can see my partition and all my files through Testdisk but I am not able to copy them to another drive. When I try to copy the option I get is of copying them to the DVD and not to any other partition.
I'm trying to resize a partition on an IDE hard disk to use the entire disk but can not get more than a 309GB partition. I can get 295, 300, 301, 302GB, etc... fine but start getting problems with anything over 309GB. I get the following error with 310GB or more:
error: block relocator should have relocated 533 Warning: You should reinstall your boot loader before rebooting. Read section 4 of the Parted User documentation for more information. I am using Slackware 12.1, GNU parted 1.8.8, ext2 filesystem.
I really need some help here. I was installing Ubuntu 11.04 supposedly on a Desktop but I had my external hard disk connected via USB. This external hard disk had two NTFS partitions with lots of important personal and my works.
I accidentally installed Ubuntu upon it and I believe I had created new Linux partition for the Ubuntu installation. Is there any way to undo everything?
I was dual booting Ubuntu 8.10 and Windows Vista on a Acer Aspire 5920. My laptop went for service and the company said they will give me a fresh laptop instead of the one I am using now for they cannot set it right.
When I plugged in my hard disk through an external cable onto a windows machine it detected only the data present (which is almost negligible in my case) in the vista partition. I would like to transfer all the data I have from hard disk at least the one in the Ubuntu 8.10 to my new laptop on which I plan to run Ubuntu. Can someone guide me on how to go about doing it? Also is it possible to transfer all the installed softwares so that they start running in the new laptop without any extra effort?
I need to resize a NTFS partition in a disk for which I have an image (dumped with dd).
I mounted it through the loop device on linux:
# losetup -o 32256 /dev/loop0 disk.img # I got the offset from looking at fdisk's output # mount /tmp/t /dev/loop0 # ls /tmp/t [content of NTFS partition shows correctly] # umount /tmp/t # gparted /dev/loop0
gparted shows me the disk correctly; it just contains one large NTFS partition I want to shrink.
I have it had it running for one hour now.
Question: will this work? There is lots of disk access but the timestamp and size of the underlying file disk.img remain unchanged.
I'm actually not a Linux newbie, but I'm DEFINITELY no expert either... I'm trying to copy all my data(approx 50 GB) from a usb drive(western digital 250GB) with ntfs partition in one go... The problem is that it only fails for big transfers... works fine for smaller transfers like 1Gigs or less... I have just one internal hdd partitioned into two ext3 partitions.. so I have sda1(Primary.. mount pt /), sda2(swap) and sda3(mount pt /piyush)... The usb drive comes up as sdb(sdb1).. just has one ntfs partition... I've also installed the ntf-3g drivers.... but doesn't seem to work... I've also noticed that when the machine hangs and I try to shut down, it fails and I get a message again again... (sdb1- no sense detected) or something like this... don't remember the exact message... will post the exact one if no one is able to figure out what's wrong...
i have installed Salix 13.1 LXDE version (Salix 13.1 is compatible with Slackware 13.1). I must use various external hard disks formatted with NTFS. The hard disks are automatically recognized and mounted with PCmanFM file manager, but only user root can write on them. How can I allow normal users to write on automounted external ntfs drives?
Does someone know how to reconfigure this? I have three hard drives.
1. Sata 1TB. It has Windows xp and ubuntu 10.10 on it 2. old 30G drive. It has ubuntu 10.04 on it 3. Old 120G with ubuntu 10.04
I installed the oses on each drive by disconnecting the others. So each drive has a boot record, and I can choose by pressing F11 at boot. All ubuntus can see and mount the NTFS partition except the one I installed last. It's on the 120G drive.
i have 2 harddrives. a 6gb and an 11gb. IDE ATA. i want to install opensuse 11.2 on them, using EXT4, in a different way this time. i want the "/" partition to cover all of the 6gb, with the drive set to master. For the slave, I want the "/home" partition on the 11gb, covering only 10gb on the beginning of the drive, and i want the swap space partition on the end of the drive using 1gb. Is this a smart way to install it? Will i have to continuously mount the drive with home and swap on it? What is the best configuration for using these two drives?
Just installed opensuse 11.3 Kdeversion on my laptop. Before installing it on live mode i had a problem of accessing my other drives (NTFS, FAT32 and EXT4) which said HAL system policy...etc mounting error. I could access all drives with root privilege. I thought problem will be solver once i install opensuse on my system. How ever i was really disappointed after seeing the same problem post install. Googled around for the solution and got this link
After this the problem got worse now i am not able to see any of the drives in the side panel. Gone through many forum and posts all discuss about external USB HDD.
When we copy a sector to a file like using dd command, the data in the file is of which format? and of which type of conversion is nesessary to see the data in read able formate. i have tryed the ASCII conversion in dd command but still the data is in un-readable format. and also tell that if i access hard disk sector's data using c language program and copy data to a file then which type of conversion should i do ?
I have a directory /var/log/data its about 80 GB,It filling up quit rapidly.I don't have much space left in the system them So i will attaching another External HDD.My question is that i need to mount /var/log/data to new HDD.So i have old data and pulse new coming up.I don't want to copy data from /var/log/data then mount new HDD to /var/log/data you know what i am taking about is there a simple way like linking or any other.
Original disk: XP NTFS primary Linux / ext4 logical Linux /home ext4 logical Win 7 NTFS logical NTFS data logical swap space NTFS recovery partition
I tried to install linux, as there was a problem with XP overwriting grub, I chose write grub to /dev/sda8 (which is where the linux install was appearing earlier).
I guess this borked the filesystem somehow. Now the NTFS data partition and the swap space are appearing as one free space. Well actually before that some linux live CDs (including gparted were seeing the entire drive as unpartitioned). I had to go into XP and delete the /ext4 partitions.
Is there any way for me to recover the NTFS data partition ?