[nflug] attempting data recovery (after total screwup)

[Stephen Burke]

Thanks for the advice, guys. I'll definitely look into the helix cd, as 
I'm always psyched to test out ALL new flavors of linux.

Actually, I probably should have studied matters a bit more before 
sending that off while I was still in the "oh, fuck!" stage of the game.

After calming down for a little longer, I realized that the reason I was 
seeing such a screwy picture in the properites window was that the 
partition was not actually mounted. Apparently I'd gotten far enough 
along in the formatting process to wipe out the ext3 journal and (in 
some way that I still don't fully understand) turn it into an ext2 
partition, which I found out by firing up gparted and seeing it listed 
as ext2 and also still full of quite a bit of data.

Once I mounted it as ext2 (and changed fstab so that it mounts properly 
on boot now) I found all sorts of files and folders in "lost + found" 
named "#xxxxxx". So I chowned lost + found back to myself instead of 
root and dug into manually sorting it all out.

Interestingly, everything that was at least 3 directories deep remained 
intact, requiring very little recovery, ecxept renaming the numbered 
folder to what it should be - mainly many, many cds that I spent a long 
time ripping a few years ago (about 50-60 GB or so), I'm thinking I 
should probably rethink my whole organization stategy on ALL the 
partitions here, but I'm also HOPING not to do such a thing again.

For the rest, fortunately, vlc will apparently play almost anything 
(where kaffeine and mplayer won't), whatever the name is, so I was able 
to recover quite a bit of the loose #xxxxxx mp3s, mpgs, and avis by 
opening them in vlc to figure out what they were and renaming them to 
what they should be, and now kaffiene and other players will play them 
happily again. Alot of the loose mp3s still had good ID3 tags, too, 
which helped things. I did end up with about 700 MB of files of type 
"unknown" that I had to simply delete since I was sick of dealing with 
the whole thing by then.

So, after a few days of mucking about, renaming, etc, it appears that I 
only lost about 10-20 gigs of data instead of the 100 or so that I was 
first kicking myself over. While it would be interesting, perhaps, to 
know what it was that was lost (since I probably wouldn't have saved it 
in the first place unless it SEEMED important at the time), it's 
basically all over but the crying now. None of it was data that my life 
or livelihood depended on, fortunately, but I REALLY didn't want to have 
to rip all those mp3s and avis all over again.

It did seem somewhat odd with all the recent talk of dinosaurs and such 
that I am the only one to pull such an idiotic move, but probably most 
of you are wise enough by now not to admit to such a thing.

I long ago lost count of how many different systems I have put on the 
various hda's here, and every time I have checked and rechecked (and 
then remained nervous) to make sure that nothing was happening to that 
partition while the various systems were installing. Except for that 
last time, of course. Now it will be TRIPLE checks. At least.

Thanks,
S.

matt donovan wrote:
> you can always grab Helix live cd and try that you might be bale to get 
> everything you need since it's full of tools for this type of thing.
> 
> On 4/18/07, * paul costa* <paul at paulcosta.com 
> <mailto:paul at paulcosta.com>> wrote:
> 
>     Stephen Burke wrote:
>      > Hello all,
>      >
>      > I guess maybe this might be a lesson in NOT doing things before being
>      > fully awake, but I screwed things up majorly here this morning
>     and I'm
>      > not quite sure if I can recover or not.
>      >
>      > I have this machine with 2 200G drives in it. The first, with the
>      > system on it is the removable variety and the second was for dumping
>      > data onto that I wanted to be able to use from whichever system was
>      > running on the first. (mostly ext3 and some fat32 and ext3 -since the
>      > main system here is dualbooted 'nix and xp -with a swap area in the
>      > middle)
>      >
>      > Since I had a free drive to pop ino the first hd slot, I thought I
>      > would attempt to install slackware 11 on it since I haven't yet
>     really
>      > dabbled in the slack realm.
>      >
>      > SO, after using fdisk to set up new partitions on the slack disk, I
>      > started merrily running through the install options, thinking that
>      > since I had just set up /dev/hda in fdisk that that's where slack
>      > would assume it was supposed to go. So I hit "ok", not reading
>     closely
>      > enough to see that it was asking to format hdb3 instead of hda3.
>      >
>      > I noticed after a couple of seconds that it was hitting hdb and
>     killed
>      > it, but not, apparently, before it deleted the journal (was ext3) and
>      > presumably quite a bit of other crucial information.
>      >
>      > Then, trying to recover things, I booted up the main OS here which
>      > naturally started complaining when it hit that data partition. So I
>      > ran fsck there, which of course complained even more when everything
>      > was out of whack. That was followed by all sorts of clearing of
>     broken
>      > inodes and fixing of stuff, which I answered yes to all of, hoping
>      > that things might be put straight by that. There was alot of
>     talk  of
>      > moving things to "lost+found" during that where once again I hit <y>
>      > for everything, once again, full of futile hope.
>      >
>      > Everything boots fine, now, but when I look at that partition I see
>      > absolutely nothing. and when I look at the properties window I see
>      > "5.4 GB out of 9.8 GB (46% used)" when actually the partition should
>      > be 121.5 GB.
>      >
>      > My question now is: since I killed the format before it went too
>     far,
>      > is there any hope of recovering any of the data that WAS there,
>     or did
>      > I screw it up further by letting fsck "fix" and "clear" everything?
>      >
>      > Any particular data recovery tools that I might look into, or is
>     now a
>      > "fait accompli" and I just have to resign myself to paying the price
>      > for being a bonehead?
>      >
>      > Any advice at all is most welcome at this point, if only how to
>      > recover the 100+ GB of new space where I might put other stuff.
>      >
>      > Thanks,
>      > S.
>      >
>      > _______________________________________________
>      > nflug mailing list
>      > nflug at nflug.org <mailto:nflug at nflug.org>
>      > http://www.nflug.org/mailman/listinfo/nflug
>      >
>     that sucks,
>     I did similar thing once, but I was lucky enough that I backed up my sys
>     to another drive before I ruined it
>     have you tried installing the drive in another machine as a slave or
>     external usb drive, mount it and see if you get lucky ?
>     I don't have any software solutions for data recovery off the top of my
>     head but I remember an FBI agent giving a demo of data recovery tools at
>     school that he said you can download for a try. It was some type of
>     forensic data recovery software. You could probably find some info on
>     google
> 
>     peace
> 
>     _______________________________________________
>     nflug mailing list
>     nflug at nflug.org <mailto:nflug at nflug.org>
>     http://www.nflug.org/mailman/listinfo/nflug
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> nflug mailing list
> nflug at nflug.org
> http://www.nflug.org/mailman/listinfo/nflug

_______________________________________________
nflug mailing list
nflug at nflug.org
http://www.nflug.org/mailman/listinfo/nflug