Recover lost disk image from real disk

[Takanuva]

Hi!

I stupidly deleted a entire disk image from a real disk, which had several important things.
The real disk has 120gb and an ext3 filesystem, and nothing was written to it after I removed the image...
The image, root.disk, is a loop image that has a 29gb ext3 disk (yes, it was a WUBI disk).

Well... I am working on this on several days and nothing worked!
I used several recovery tools for ext3, but nothing seems to work right.

Testdisk has found it as a real partition, so I wrote it to the partition table, and it was there, the 29gb partition, so I made a copy of it (as well as a raw copy of the real disk too).
I couldn't mount nor restore it after copying this way... Probably the file was fragmented, so just the first part of it is write...

I really need this disk, and if some guru know what to do, I would really apreciate some help.

For now, I know that the virtual disk (root.disk, which I need back) has exaclty 31138512896 bytes, it was in the inode 152 of the real disk (which is marked as deleted now), and the start of the image (which testdisk found) was in the sector 55289 of the real harddisk.
I am not sure of how the ext3 filesystem works, but maybe with this I can found where are the other parts of the disk, if it is fragmented...
I used ext3undel too, but it said that I couldn't recover my file because it was not in the journaling.


I don't know what I can do anymore.

Please, someone help me.


Thanks.

[rodrigth]

Hello,

This is unfortunate! I have done this on accident a couple times, but never on the partition that held my home directory. How did you erase your ext3 filesystem?

Regards

[redbook]

You could try testdisk, I have had some success with it in the past.

[jippie]

I am missing a lot of information in your story, but my first guess would be 'photorec': PhotoRec - CGSecurity

If you have an image of the rescued filesystem, you should be able to mount it, which should go something like:

mkdir /tmp/tempmount
mount -o loop image.raw /tmp/tempmount

[Takanuva]

If you have an image of the rescued filesystem, you should be able to mount it, which should go something like:

mkdir /tmp/tempmount
mount -o loop image.raw /tmp/tempmount

I tried ProtoRec, but it searches for files by their characteristics, so it is not able to find a huge image file. It did not work.
PhotoRec fails in the real disk, because somewhere it finds the "virtual partition", and I get segmentation fault. In the image partition that I could copy directly, I think it was copied just a part of it, if it was fragmented, so PhotoRec couldn't rescue any file from the image either!
Testdisk found the image file as a real partition, this was the way I found where it started in the real hard disk.
Ext3grep and ext3undel both said to me the file was in the inode 152, but marked as deleted.
I copied the raw 29gb after the beggining of the file, but it did not mount, nor the backup sectors where valid - I think the file was fragmented within the real disk.

Everything I did in the real disk after the deletation was in read-only mode, that's why I hope to get my image disk back.

But nothing until now did work right.
The only thing that comes to my mind is to edit the inode 152 manually with an hex editor to point to the right sector/position, but I don't know if it will be able to find the other fragments of the huge image file.


Please, someone, help me! There were lots of personal data and documents/code from my work (I'm a analyst, I'll get in trouble if a lose all of this)...
You may say "but you didn't have a backup?", well... I was doing a backup when I deleted the original! I know, this was REALLY stupid, but...

[oz]

If TestDisk won't work to getting it back, I think you are probably out of luck unless you want to seek help from one of the professional recovery services, and even then it's possible that they can't retrieve it either. It's generally a good idea to keep multiple backups on hand, stored in different locations, because bad things can and do happen to backups.

Good luck with it... hope you are able to recover all of it in some way.

[Takanuva]

If TestDisk won't work to getting it back, I think you are probably out of luck unless you want to seek help from one of the professional recovery services, and even then it's possible that they can't retrieve it either. It's generally a good idea to keep multiple backups on hand, stored in different locations, because bad things can and do happen to backups.

Good luck with it... hope you are able to recover all of it in some way.

It is because it wasn't a real partition, it was a file called root.disk with a ext3 filesystem inside of it (I used to mount with -o loop), but testdisk found where it begins (it found the ext3 signature, in the beggining of the image file, and thought it was a real partition).

I am desperate already. I need this file back. =[

[gnuuser]

caine 1.5
this is a forensic distro that has a lot of recovery apps.
also you can use puppy linux to recover files.

then there is system rescue (graphic user interface)
you can find these at distrowatch and linuxlinks.com

[ghep]

you need dd_rhelp and dd_rescue. You will also need another hard disk to recover onto. Yahoo them and read up on them. I have recovered several HDD's using them. Not deleted HDD's but ruined and inaccessible. dd_rhelp runs on the back of dd_rescue and gives you a command line interface where you can see that it's working, whereas dd_rescue on it's own just has a flashing cursor. As this may take a few days you might think it's crashed after watching the cursor blink for a few hours! You can put them onto a floppy and boot from from a knoppix cd.

Good luck and be patient ...........