[SOLVED] Yikes! Oopsy!

[Dan]

I don't really want to talk about how it happened ... but ...

the 411:

A backup drive with a MINT10 install being used for back-up file storage
An unguarded moment with gparted, and the wrong drive selected.
All partitions deleted

I haven't written anything to it since. (I figured out the screw-up when the wrong drive noise came out of the box.)

Question: (to which, I'm afraid I already have the answer.)

Is there any reasonable way to restore the partitions, and therefore the data?

[glennzo]

Somewhat of a senior moment Dan? Seriously, wish I could tell you what you want to hear, but ... I can barely turn these danged things on.

[Dan]

Uhm ... Yeah. 500 gigs of photo archives just went into the great galactic bit-bucket. <....>

[dd_wizard]

I've never had to do it, but I think I've read that partitions can be restored. If not, the bits are still there, unless you did a low level format. Considering my lack of experience, I'd say google is your friend. I'm sure there's a good thread by Anduic? perhaps on recovering data from dying drives.

Good luck,
dd_wizard

[glennzo]

That really s*cks. Any of it on old forgotten and decomissioned hard disks?

[jpollard]

Do you happen to know what the partition table entries were?

Mostly you just need to know the size of each partition, then recreate the list (mind, in the same order).

Once the partitions are re-established, everything should just suddenly reappear.

The only things lost should be boot blocks, and if you had LVM volumes on there (might be tricky).

I've done that - once with a "blank" new disk from the vendor (it had no partition table). I then, out of curiosity, ran a fsck on it before creating a filesystem... and poof - there was a valid filesystem. The only file in that filesystem turned out to be a slightly modified source to the date command.

[smr54]

https://www.linux.com/news/enterpris...our-hard-drive

Untested by me. I did once try test disk after a drive containing part of an LVM died, and the files were there, just almost impossible to find.

[Evil_Bert]

I feel your pain.

Originally Posted by Dan

Is there any reasonable way to restore the partitions, and therefore the data?

Reasonable, no. But maybe possible.

I've not heard of any other way, but I've recovered some data (at work) before via a forensic service - data was extracted byte by byte, but what you really want to know is whether the partition/file tables can be recovered. I'd contact a professional forensic service and ask what they can do.

I use alternating backup disks and keep them locked away for this very reason ... not that that's much consolation now.

[dd_wizard]

Here's the thread I was thinking of, Dan. I almost spelled the author's name right, it's Adunaic.

dd_wizard

[Fenrin]

Autopsy Forensic/sleuthkit is a tool which can maybe help. I installed it once, but it seemed to be pretty complicated to use.

If you want to restore data, it's (probably) important that you don't create a new filesystem on the disk.

Since sleuthkit is a filesystem parser, if you overwrite your filesystem with a new filesystem, it can not really help you.[...]

from the sleuthkit mailinglist: http://sourceforge.net/mailarchive/f...leuthkit-users

Ah just looked if it also supports ext4 as filesystem and found this user report: http://www.linuxjournal.com/content/...forensics-ext4
so unfortunately this tool will be probably not of much use. It supports only: NTFS, FAT, UFS1/2, Ext2/3
But you can read the above report and comments on it nevertheless. Maybe something helps.

open source forensic tools:
http://www2.opensourceforensics.org/tools/volume-system
http://www.digital-forensic.org

times like this you need leigh around . goodluck Dan

[AndrewSerk]

What about testdisk/photorecord?

[sonoran]

What about gparted's Device/Attempt Data Rescue menu entry?
Looking at the gparted docs, they recommend using testdisk to recover partition tables:
http://gparted.sourceforge.net/displ...artition-table

[zuchov]

Bad, really bad man.. whatever You do: Do NOT create a new file system if You are going for the data at the disk. Sorry to hear about it man. I myself ALWAYS disconnect every other drives than root+home during system install. Good Luck man.

[Gareth Jones]

Was it only the partition tables that were changed? If so, searching for ext4 super-blocks should find the start blocks of the old partitions if you don't remember the details. I'm not sure how to do that off-hand, but I guess there should be magic numbers and header structures that can be searched for, or maybe the software others have mentioned can do it.

If you've modified the partition contents (e.g. formatting them), ext4 creates back-up super-blocks at regular intervals, so unless your new partitions match the old ones exactly, there should be old ones still present. After finding them, it's presumably a case of using fsck (with the -b option) to retrieve whatever hasn't been overwritten. It'd be a tedious process but I expect the bulk of your data (and file-system structure) should be intact as long as it wasn't physically overwritten.

---------- Post added at 01:39 AM ---------- Previous post was at 01:39 AM ----------

Oh, and insert the usual stuff about working with images rather than the original drive if that's feasible. I assume some of the software mentioned by others does this stuff for you, the main point is that most of the data should be recoverable with the right software, or professional data-recovery services.