Find the answer to your Linux question:
Results 1 to 4 of 4
My situation seems to be rather unique after browsing around searching for a solution: I have the following setup with two disks: SDA: SDA1 => /boot (~1GB) SDA2 => / ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined!
    Join Date
    Nov 2008
    Posts
    4

    Did something stupid and need help (ext3 data recovery)


    My situation seems to be rather unique after browsing around searching for a solution:

    I have the following setup with two disks:
    SDA:
    SDA1 => /boot (~1GB)
    SDA2 => / (~3 GB of 240GB)

    SDB:
    SDB1 => /data (ALL my personal files ~250GB)

    I accidentally attempted to create a software RAID partition across SDA1 and SDB1 and succeeded (a la mdadm --create /dev/md0 --level=1 --raid-devices=1 /dev/sda1 /dev/sdb1). ALL of my personal files were sitting on SDB1 venerable and are now gone in place of files that were on SDA1 (vmlinuz, grub.conf, etc.).

    My question is did ALL of the data outside of the first gigabye get wiped clean in the RAID device creation? The synchronization from mdadm finished quickly so I would think not. What chance do I have at recovering the data beyond the first GB on SDB1 and what methods might I use to attempt recovery?

    MANY MANY Thanks in advance!

  2. #2
    oz
    oz is offline
    forum.guy
    Join Date
    May 2004
    Location
    arch linux
    Posts
    18,733
    Welcome to the forums!

    I don't know if it will work, but you can check out TestDisk and/or PhotoRec:

    TestDisk - CGSecurity

    Lots of folks have reported success using them.

    You can find TestDisk on the PartedMagic LiveCD and many other liveCDs.
    oz

  3. #3
    Just Joined!
    Join Date
    Nov 2008
    Posts
    4

    Unhappy Testdisk not finding anything...

    I could be utilizing Testdisk incorrectly but it does not seem to be picking up anything or finding data on the drive. I am using the last set of instructions found here:

    Data Recovery Examples - CGSecurity

    This does not find the data. I have done deepscans with testdisk and not had any luck either.

    I have had luck with PhotoRec but unforntunately the files come back as a big glob of crap (f13426462.txt, f231451235.jpg, f34141532.tar.gz, etc.)... Is there anyway to recover the directory structure / file names?

    I had heard mentioned before the suggestion to DD an image as a backup file and then parse out the files from this? Is this a possible solution? How might one go about doing the DD and parsing?

  4. #4
    Just Joined!
    Join Date
    Nov 2008
    Posts
    4

    Unhappy ext3 Data Recovery...

    So the situation is this: I synchronized (via mdadm RAID 1) a ~1GB ext3 partition over a 250GB ext3 partition . I have tried a vast amount of Windows and Linux recovery tools (R-Linux, Testdisk/PhotoRec, Pheonix Linux Recover, etc.); a majority of these tools seem to look for deleted files (some files are showing up that I do not wish to recover that were probably deleted long ago) and even still are unable to restore the filenames and structure.

    A HUGE bulk of the data still lies on the disk and I know it; I just cannot get to it! I am willing to pay someone $250+ to tell me how to recover this data. I know it can be done because I have sent off a duplicate of the drive to a data recovery shop who will successfully recover the data (sent me a list of the filenames and directories!) at a hefty bounty that I am not definitely not willing to pay . If anyone knows how I might tweak the aforementioned tools or perhaps, through using dd images etc., pluck out most of the ~250GB of data I would be extremely grateful and willing to pay for help!

    Details:
    [Drive /dev/sda]
    /boot (1GB) (sda1)
    swap (4GB) (sda2)
    / (238GB) (sda3)

    [Drive /dev/sdb]
    /data (244GB) (sdb1)

    Command run:
    mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sda1 /dev/sdb1

    This synchronized /dev/sda1 => /dev/sdb1 presumably overwriting only the 1GB at the beginning of the disk contents. I first had the directionality wrong and second had not yet setup the partitions on /dev/sda even if I had it correct to begin with. Before I knew the ramifications I hit confirm without batting an eye. It was all over in a matter of seconds by the time I had realized what damage had been done. I am not up much on filesystem / disk structure and beyond that am not very familiar with how I might leverage that knowledge against recovering my data so perhaps there is an expert out there that can shed some light on this!

    Thank you for you help in advance! Any recovery information can be posted publicly to this thread and a private message can be sent for information on collecting a reward for the recovery of this data. Thanks again !

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •