Ubuntu :: Data Recovery After Accidental Reformatting
Jan 16, 2010
I just erased +200GB worth of photos, documents, music and videos on my external hard drive.I wanted to try the new Ubuntu Lucid Lynx Alpha 2, so I downloaded the .iso, launched the live USB disk creator and tried to format my 1GB pendrive to make room for the OS. Somehow, I ended formatting my 320GB external USB hard drive. The hard drive had to partitions (one EXT3 and one NTFS), but now it only has a FAT partition that spans the whole drive.I understand that the new FAT partition may have erased the EXT3 data structures at the beggining of the partition, making file recovery next to impossible.A confirmation dialog on the live USB disk creator wouldn't have hurted either.
Yesterday, my Windows 7 machine managed to somehow destroy a SD card with some pictures on it. Now, every time the card is inserted into a computer running windows, or the camera it came from, it asks to be reformatted. Obviously I would like to recover the pictures from the card.
I tried a scanning the card with a windows program "card recovery" and the program was able to scan the card and find the images on it. But I have to pay $40 to actually copy them from the card to the computer.
So I did some digging and tried to find a way to recover the data for free using my Ubuntu machine.
Some details about my hardware: Running Ubuntu 9.04 SD card: 8Gb SDHC from PNY Optima The camera was a Nikon D5000
What I have done so far: I used ddrescue to create an image of the card. However, at this point, most of the instructions I found only have you try and mount the image. Then I used the testdisk utility and the mmls utility from the SluethKit to try and find a partition on the SD card image that I could mount. Both of these programs failed to identify a partition on the card.
A friend's old Compaq Presario came with Windows XP. However, when it got buggy (without his knowledge or consent), his kids overwrote his OS by installing a warez edition of Windows 7 Ultimate. Unfortunately, that wiped out all his data, including photos of his late wife that he does not have backed up. I want to recover those if possible. I don't want to install anything because that may overwrite the photos if they're still there in some shape or form.
What I'm wondering is if there's a DVD-bootable distro of Linux specifically for data recovery. If I could boot to that, I could run its data recovery utilities without danger of putting anything on the hard drive. Once I've recovered the photos and backed them up to an external hard drive, I'm going to make his PC legal by installing Ubuntu. That's no problem. I'm very up to speed on that. What I need to learn is the best data recovery strategy via some type of bootable Linux. I suspect someone has written such a tool given how often people lose data due to viruses, accidental deletions, formats, etc.
A while ago my harddrive kinda failed. I didnt notice untill I got "Grub error 17" one time when I was trying to boot my computer. The problem is not really that I couldnt log on to my computer, but rather that I have alot of important information on the computer I would hate to lose. At the time I used Ubuntu 8.04 and had reiserfs filesystem on the computer. I bought a new computer and decided to wait untill I could rescue the data before doing to much dmg to it. But I dont really remember if I tried something to fix it before I realised that it was the harddrive and bad sectors that made me get gruberror 17. Hopefully I didnt do anything.
Anyway. Now today I had some extra time, so I decided to dive in. I booted from a linux mint disk and used ddrescue to transfer all the rawdata over the network to an image file laying on an ext4 drive. Once there I used reiserfsck to try and repair the filesystem. After that i mounted the image file and tried to access the files. Thats where the probelms started. I could see the whole treestructure of the harddrive and everything seemed ok, but when i tried to open the files, none of the pictures, documents and so on could be opend, and when I tried to open stuff like MP3 files they played quite strange. Videofiles was really messy, kept changing resolution and was almost always just gray and green squares on the screen. I decided to use ddrescue and move the files from the image file and on to a clean disk. So when I was done I could mount the filesystem on the new disk, but with the same resault, so I did reiserfsck again, and when that didnt help I did a buildtree also. Still with the same resault. So I decided to investigate the data abit. Opening files at random trying to understand what had hapend. And I saw that some MP3 files (the easiest to open) was some kind of mixing between several difrent mp3 files. Some files wasnt even in the same folder, so it was probably just that the file pointer was pointing at the wrong data on the disk. I dont know how that works really, so I dont know how to go on.
So now to the question. How do I get the data back? Have I done something wrong, can I redo somethig? I still have the broken disk and can take data from it once again, but I want to wait to do that untill I really know what to do. I also still have the image file, and the disk with the copied data. I have a ubuntu 9.10 system at my disposal atm.
Could I please have some recommendations for Data Recovery of a Formatted Drive. There are so many choices out there that I don't know which one I wanna use.
I have somehow managed to eradicate all of my films and music...I was going to update my external HDD (typical) and so I highlighted everything and went to drag it. My finger kind of slipped while the cursor was in the the same folder and I got a message saying something like:"Source file is in this destination. Cannot move. Do what?"There's me thinking not much can go wrong at this point so I clicked "Skip all".Everything disappeared
The file system says there's still only 500GB free on my 1.5TB, so the files are there but I just can't see them.how I can get them back?There's nothing in my 'Deleted Items' and I had a play with scalpel and PhotoRec and I either couldn't get them to work or they said they'd take way more time than I have.
Edit: Where did that smiling devil come from? That's really not how I feel right now.
I'm trying to learn how to use foremost, a data recovery tool. I thought a nice place to start would be by attempting to recover a file from a test image. The foremost website links to this site which has a FAT Undelete Test #1 challenge. The challenge is to recover files from a 6 MB FAT disk image. I tried running this command. foremost -t all -i /home/<user>/Desktop/6mb.img -o /home/<user>/Desktop/output but all I got was a folder with an audit.txt file in it.
Today I wanted to make a backup of my Ubuntu server. Since the program wasn't working for me, I rebooted my computer and right now it wont boot. Now I entered recovery mode and I'm trying to recover my /var/www and /etc/mrtg folders. I want to copy them to my USB-Stick but Ubuntu wont do this.
The command I tried: Code: cp -r /var/www /dev/sdg1/www I already created the folder via a other system. I also tried to mount the USB stick: Code: mount /dev/sdg1 /mnt/usbe But im getting the following error: error while loading shared libraries: /lib/libsepol.so.1: Invalid ELF header.
I'm running 10.04 LTS (64 bit) During a recent attempt at dual booting Windows 7, the Windows installer made a boot partition on the wrong drive, formatting the drive, and therefore destroying all my data.
The original partition was NTFS, and the new (unwanted partition) is NTFS.
Is there something in Linux I can do to recover the data that was there, or am I going to have to install Windows on yet another drive and use some Windows tools?
The data on this drive is extraordinarily important, containing ten years of digital photos, my source codes, and musical compositions (protools sessions etc).
I have a windows install that is totally hosed, bluescreens, etc. I want to try to force mount it from Ubuntu to get whatever data I can, but it won't allow me to mount. It keeps telling me to run chkdsk /f and reboot twice. But that's not possible. I was wondering if there are any ntfs tools for Ubuntu or any data recovery tools I can use to get what I can from this drive.
The other day one of my hard drives on my windows system decided to stop working. Not entirely sure what happened, but it seemed that it just erased its partition header, although I wasn't able to recover it.
Anyway, I successfully got an image of the drive using GNU_ddrescue (yay!), and I'm currently salvaging what CAN be salvaged with foremost.
way to get EVERYTHING off of the drive? I mean, it seems that it's all intact (since foremost is finding so much stuff).
I've tried mounting the partition, but it's not working. (I'd post the output from the terminal, but the forum thinks there is/are URL(s) in it....)
I have a fedora file server with a raid 1 array acting as a NAS for my local network. I accidentally overwritten a file that I need to recovery. What are my chances of recovering this file?
I'm trying to recover my Western Digtal 500GB hd (connected through IDE), I've already succesfully recoverd 80GB with copyr.dma (didn't have a bigger IDE drive laying around). and want to do the rest of the drive with GNU ddrescue. I use the Parted Magic live cd to do this. The problem is that I can't find my HD, although it is listed when I look in the Hardware info app. How can I access it as /dev/hda or /dev/sda or whatever it wants?
While install Ubuntu on an existing xp pro I accidentally formatted my hard disk. Is there any way to get back my files it contains e books pdfs photos music files and movies. Data recovery. My Hard Disk 80GB SCSI NTFS.
My laptop died. I was running FC11. I have taken my harddrive out and connected it to an usb-adaptor and mounted it on my FC11 desktop. However, when I open it all I see is grub. Palimpsest sees both the 250MB of grub and efi etc., and it also sees 120GB of LVM2. I cannot however access any of my data.
A friend has a embedded system (korg recorder) with a ata drive in it, that crashed. We are trying to come up with ways to retrieve the data off of the drive. I'm asking in security as this seems like it would be close to forensics, hence security. Hints on software for linux to help either recover files, move files, copy/clone the drive? I'm not so concerned about the korg's os on the drive, as we can create a new blank drive and install that, its the data that is critical, that needs to be recovered. The original korg os was only recognizing drives up to 100gbs so I'm guessing this might be a fat16 filesystem if that helps. Well, that and the program installed to the drive to run it in the korg is an exe.
I erased my partition table. Can anyone recommend a good method of reconstructing it? And if this is impossible, can anyone recommend a good method of data recovery? I had an ntfs partition with windows 7 and a larger ext3 partition that ran Debian.
I'm running Test-disk on the SystemRescueCD at the moment (cross your fingers).
I am tryiing to recover data on an iPod Classic hard drive which will not sync anymore with iTunes. I pulled the drive and connected it directly to the usb port on my Ubuntu system.
I used ddrescue to image the drive and fdisk -l to try to understand where the partitions were. I got the following:
Disk /dev/sdg: 80.0 GB, 80026361856 bytes 255 heads, 63 sectors/track, 9729 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Sector size (logical/physical): 512 bytes / 512 bytes
I have just upgraded my lenny box to squeeze. I did it by clean-installing squeeze. The installation was successful, but I just noticed that I had forgotten to backup some important files I had on this machine before the installation...
It's my first time i switched to linux (fedora13) and i wanted to check out ubuntu10. Started installation but somehow (stupid!) selected not the right harddrive to install new system from an iso dvd. Well installation was not successfull, because not the right drive was selected.I came back to fedora but my "storage" harddrive that i had all my collected data and projects is lost. Basically it's like new formated and some files from the ubuntu 10 are on it. None of my files. Is there any way to recover it back? I don't even have a clue how do you install software to fedora13?(I'm a newbee that was sick and tired using and upgrading windows - so now mac OZ and linux)
I'm building another PC that will be used as a workstation specifically for recovering data from hard drives and backing up the info and I want to install linux as the OS. Which Distro would you reccomend I use?
While attempting to install FC12, Anaconda took it upon itself to overwrite the partition on my backup disk. Now I need to figure out if there's a way to get at least some of my data back. If there's a better place for this question, please let me know and I will happily move it. Using Linux since 1993, other Unixoid systems since 1986. I bought this machine back in 2004 or so. It was a pretty decent machine back then, but it's showing its age now: 370Mb of RAM, 2 hard disks with 80Gb and 120Gb (I don't think the other specs are relevant, but just let me know if I'm wrong). In a fit of insanity, I decided to install Gentoo on it. Don't get me wrong: I love certain things about Gentoo. But the constant fiddling that's required, while it can be fun at first, gets old kinda quick.
So various and sundry things have been going wrong with it here and there (CD-ROM, sound card, etc ad infinitum), and, finally, it wouldn't even load X any more (almost certainly some final Gentoo update which broke something) and I said "screw it, I'll just put Fedora on it." This is what I use at work, and plus I have a good friend who has far more patience with admin stuff than I do and Fedora is what he knows. So, last night, I pick up an FC12 CD that I have lying around and decide to finally just reinstall the whole thing. I went so far as to buy myself a Passport USB drive, 319Gb, and have been backing up up all my stuff very regularly to that drive. I go through one final cycle of backing up and verifying before I start the reinstall.
So my drive is solid, and contains everything I could possibly need (and probably quite a bit of stuff I don't). After booting into FC12, I used Palimpsest to explore the partitions on the existing hard disks. Not sure which was which, I mounted the Passport, where I have cleverly saved a copy of my fstab. Using this, I can see which of my partitions were /boot, /, /home, etc. Most of my personal data has been put into separate partitions so that I could reinstall without blowing away the data. I hope that I can do that there, but, if I can't, no matter: I have a backup. I find some bits of empty space and delete a few of the partitions and recreate them, consolidating the empty space. Still confident in my backup, of course.
So I run Anaconda. Nothing happens. Eventually, I figure out that it won't run the graphical interface because I don't have enough memory. I can use the text version, no biggie. It gets to the part about the disks. I tell it which hard disk to install itself onto. For some reason I think it's going to pop up and ask me about the existing partitions and whether I want to keep them or rewrite them (maybe that's a previous version of Anaconda? or a different installer altogether, who can remember). It does not. It babbles something at me about LVM (which I've personally never really used before), and then promptly locks up. Obviously standard Fedora on a low-RAM machine like this is doomed to failure.
I poke around on the Internet, and I eventually stumble on the Fedora "spins" and select FC13/LXDE. Hopefully this will have better luck. Reboot with the new CD, take a look at my hard disks. It has completely overwritten the old partitions, replacing them with LVM partitions. But not a big deal: I have a backup. Take a look at the Passport. Its ext2 filesys has also been replaced with an LVM partition. Proceed to beat head against wall. So, obviously what happened is, since I (foolishly) had the backup drive mounted at the time I ran Anaconda, it assumed I wanted it to take over that drive as well, and just formatted everything it could lay hands on as LVM. It certainly never asked me my opinion on the matter.
But, fine, I shouldn't have had it mounted. The question is, what do I do now? My first, panicked instinct, was to just set the partition type back to 83 (I believe LVM is 8E), which I did (using cfdisk). That might have made it worse; I dunno. But I'm pretty sure I haven't written anything else to the disk since then. I've tried testdisk (nothing useful; although it can seemingly find the underlying deleted partition, it won't actually do anything with it), and a bevvy of Windows Linux recovery programs (Stellar Phoenix, DiskInternals, Raise, and R-Linux), all of which were completely useless except for R-Linux, which scanned the disk for eight hours and was still going when I had to interrupt it (I may come back to that one, but so far it doesn't look too promising).
My primary problem is that I can't make an image of the disk because this little Passport is the biggest hard drive in the house. I would certainly feel better if I could image everything off it and then play with the image. But, of course, it doesn't matter that very little of that 319Gb was actually being used: I still need 319Gb worth of space to make an image. I ordered another (larger) Passport, which should be here Wed. Once I have that I believe I can do something like so: Code: dd ifs=/dev/sdX ofs=/mnt/bigpassport/smallpassport.img bs=512 Right? Then I can muck about with that image in some amount of safety.
Of course, I also have the original hard drives, which are not so large. testdisk can identify the original partitions on those too, but, again, won't actually do anything with them. If I could find something that would image just the partitions I care about, I could probably save those as well, but I don't have any other external hard drives with 120Gb of space free. Can I somehow take the info that testdisk is giving me about those original partitions and use dd to get only that part of the image? Are there other recovery tools I haven't considered? I have a Windows (Win7) laptop, a Linux laptop (FC10, I think), although its power cord is flaky so it's not too reliable, a smaller Mac, a really old Windows box (XP on it, I think), and this formerly-Linux box, which I can only boot off CD's at this point. There's nothing on this disk worth the 500 bux that professional data recovery would charge me, but it's worth a day or two of my life to try to get at least some of it back.
I have an Nas Acer Altos EasyStore NS04 with raid level 5 (4 devices sata: Barracuda 7200 500gb)
Nas info:
Code:
And then ipstor (Falcon Software) mount several dev/VBDX for each shared folder created by web admin
After a reboot NAS was unreachable (eth0 didn't start and this is the only way to control NAS) without disks NAS work on with default params
Suggest me to connect disks in a server and start and try to mount MD device to recover data so i download SystemRescueCd-0.4.2 and connect disks to a HP Proliant ML350 G6
System starts and systemrescuecd find ad array MD127
Code:
I tryed also to recreate array in a new device (for ex. MD128) but error messages was the same
I dont' understand if problem is in md file system or superblock or something else.
I was trying to set up a partition on my netbook's hard drive, and foolishly forgot to backup my home folder. Now, Ubuntu (10.04, btw) won't boot. It allows me to get into the manual recovery shell, though. Now, I'm perfectly willing to reformat, but first I'm hoping I can recover the files from my home folder without having to take my netbook to the ridiculously overpriced computer repair centers in my area.
I have an external hard drive, but when it's plugged in during the recovery shell, it won't register as being a valid directory. I know the commands to copy or move a directory, but without my external reading as a valid directory to move my home folder to, I'm kinda stuck. Is there any other way to recover the contents of my home folder without having to go to a computer repair place? Neither of the ones in my area know much about linux at all, and I really don't want to have to pay $80+ to have someone else recover my home folder.
When installing Mint 10, I re-did some partitions, but forgot to turn off my old 30Gb external HDD, and deleted it's partitions. Which is the best software to recover it? It was partitioned with Windows software I think. Or should I use XP and freeware? Or else it will cost me $70-$80.
I specified the wrong out file while using the dd command to write a .img to what I thought was my thumb drive. Browsing the hard drive shows the liveOS folder but no longer any of the previous folders.I used PhotoRec to see if I could recover the files and it was able to recover files. So the files are still there. Is there a way to get these files without having to wait for PhotoRec to work on the 500GB drive, since this will take a while.
I accidentally formatted a 2TB drive of mine (big oops), but have recovered 2 of the 3 partitions using testdisk. My third partition is a LUKS encrypted partition. Testdisk managed to recover a piece of it, but it won't mount as most of it is unallocated. The partition originally occupied all space from sector 2,930,272,065 to the end of the disk -- sector 3,907,024,064. That is about 473 GBs. Currently, the partition only uses space from sector 2,930,272,065 to 2,930,288,129, about 7.84 MB.
The rest of the space is unallocated. Now what I need to do, is to expand the partition so that it occupies all the space that it used to. How would I do this? I cannot resize the partition, cause it would try to recreate the filesystem AFAIK and I don't want that, as it will fry my data. My data is not terribly important, but I would rather have it then not. I attached a screenie of kpartitionmanager. The partition in question is /dev/sdb2.
