[nflug] attempting data recovery (after total screwup)
paul costa
paul at paulcosta.com
Fri Apr 20 22:51:23 EDT 2007
Stephen Burke wrote:
> Thanks for the advice, guys. I'll definitely look into the helix cd,
> as I'm always psyched to test out ALL new flavors of linux.
>
> Actually, I probably should have studied matters a bit more before
> sending that off while I was still in the "oh, fuck!" stage of the game.
>
> After calming down for a little longer, I realized that the reason I
> was seeing such a screwy picture in the properites window was that the
> partition was not actually mounted. Apparently I'd gotten far enough
> along in the formatting process to wipe out the ext3 journal and (in
> some way that I still don't fully understand) turn it into an ext2
> partition, which I found out by firing up gparted and seeing it listed
> as ext2 and also still full of quite a bit of data.
>
> Once I mounted it as ext2 (and changed fstab so that it mounts
> properly on boot now) I found all sorts of files and folders in "lost
> + found" named "#xxxxxx". So I chowned lost + found back to myself
> instead of root and dug into manually sorting it all out.
>
> Interestingly, everything that was at least 3 directories deep
> remained intact, requiring very little recovery, ecxept renaming the
> numbered folder to what it should be - mainly many, many cds that I
> spent a long time ripping a few years ago (about 50-60 GB or so), I'm
> thinking I should probably rethink my whole organization stategy on
> ALL the partitions here, but I'm also HOPING not to do such a thing
> again.
>
> For the rest, fortunately, vlc will apparently play almost anything
> (where kaffeine and mplayer won't), whatever the name is, so I was
> able to recover quite a bit of the loose #xxxxxx mp3s, mpgs, and avis
> by opening them in vlc to figure out what they were and renaming them
> to what they should be, and now kaffiene and other players will play
> them happily again. Alot of the loose mp3s still had good ID3 tags,
> too, which helped things. I did end up with about 700 MB of files of
> type "unknown" that I had to simply delete since I was sick of dealing
> with the whole thing by then.
>
> So, after a few days of mucking about, renaming, etc, it appears that
> I only lost about 10-20 gigs of data instead of the 100 or so that I
> was first kicking myself over. While it would be interesting, perhaps,
> to know what it was that was lost (since I probably wouldn't have
> saved it in the first place unless it SEEMED important at the time),
> it's basically all over but the crying now. None of it was data that
> my life or livelihood depended on, fortunately, but I REALLY didn't
> want to have to rip all those mp3s and avis all over again.
>
> It did seem somewhat odd with all the recent talk of dinosaurs and
> such that I am the only one to pull such an idiotic move, but probably
> most of you are wise enough by now not to admit to such a thing.
>
> I long ago lost count of how many different systems I have put on the
> various hda's here, and every time I have checked and rechecked (and
> then remained nervous) to make sure that nothing was happening to that
> partition while the various systems were installing. Except for that
> last time, of course. Now it will be TRIPLE checks. At least.
>
> Thanks,
> S.
>
> matt donovan wrote:
>> you can always grab Helix live cd and try that you might be bale to
>> get everything you need since it's full of tools for this type of thing.
>>
>> On 4/18/07, * paul costa* <paul at paulcosta.com
>> <mailto:paul at paulcosta.com>> wrote:
>>
>> Stephen Burke wrote:
>> > Hello all,
>> >
>> > I guess maybe this might be a lesson in NOT doing things
>> before being
>> > fully awake, but I screwed things up majorly here this morning
>> and I'm
>> > not quite sure if I can recover or not.
>> >
>> > I have this machine with 2 200G drives in it. The first, with the
>> > system on it is the removable variety and the second was for
>> dumping
>> > data onto that I wanted to be able to use from whichever
>> system was
>> > running on the first. (mostly ext3 and some fat32 and ext3
>> -since the
>> > main system here is dualbooted 'nix and xp -with a swap area
>> in the
>> > middle)
>> >
>> > Since I had a free drive to pop ino the first hd slot, I
>> thought I
>> > would attempt to install slackware 11 on it since I haven't yet
>> really
>> > dabbled in the slack realm.
>> >
>> > SO, after using fdisk to set up new partitions on the slack
>> disk, I
>> > started merrily running through the install options, thinking
>> that
>> > since I had just set up /dev/hda in fdisk that that's where slack
>> > would assume it was supposed to go. So I hit "ok", not reading
>> closely
>> > enough to see that it was asking to format hdb3 instead of hda3.
>> >
>> > I noticed after a couple of seconds that it was hitting hdb and
>> killed
>> > it, but not, apparently, before it deleted the journal (was
>> ext3) and
>> > presumably quite a bit of other crucial information.
>> >
>> > Then, trying to recover things, I booted up the main OS here
>> which
>> > naturally started complaining when it hit that data partition.
>> So I
>> > ran fsck there, which of course complained even more when
>> everything
>> > was out of whack. That was followed by all sorts of clearing of
>> broken
>> > inodes and fixing of stuff, which I answered yes to all of,
>> hoping
>> > that things might be put straight by that. There was alot of
>> talk of
>> > moving things to "lost+found" during that where once again I
>> hit <y>
>> > for everything, once again, full of futile hope.
>> >
>> > Everything boots fine, now, but when I look at that partition
>> I see
>> > absolutely nothing. and when I look at the properties window I
>> see
>> > "5.4 GB out of 9.8 GB (46% used)" when actually the partition
>> should
>> > be 121.5 GB.
>> >
>> > My question now is: since I killed the format before it went too
>> far,
>> > is there any hope of recovering any of the data that WAS there,
>> or did
>> > I screw it up further by letting fsck "fix" and "clear"
>> everything?
>> >
>> > Any particular data recovery tools that I might look into, or is
>> now a
>> > "fait accompli" and I just have to resign myself to paying the
>> price
>> > for being a bonehead?
>> >
>> > Any advice at all is most welcome at this point, if only how to
>> > recover the 100+ GB of new space where I might put other stuff.
>> >
>> > Thanks,
>> > S.
>> >
>> > _______________________________________________
>> > nflug mailing list
>> > nflug at nflug.org <mailto:nflug at nflug.org>
>> > http://www.nflug.org/mailman/listinfo/nflug
>> >
>> that sucks,
>> I did similar thing once, but I was lucky enough that I backed up
>> my sys
>> to another drive before I ruined it
>> have you tried installing the drive in another machine as a slave or
>> external usb drive, mount it and see if you get lucky ?
>> I don't have any software solutions for data recovery off the top
>> of my
>> head but I remember an FBI agent giving a demo of data recovery
>> tools at
>> school that he said you can download for a try. It was some type of
>> forensic data recovery software. You could probably find some
>> info on
>> google
>>
>> peace
>>
>> _______________________________________________
>> nflug mailing list
>> nflug at nflug.org <mailto:nflug at nflug.org>
>> http://www.nflug.org/mailman/listinfo/nflug
>>
>>
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> nflug mailing list
>> nflug at nflug.org
>> http://www.nflug.org/mailman/listinfo/nflug
>
> _______________________________________________
> nflug mailing list
> nflug at nflug.org
> http://www.nflug.org/mailman/listinfo/nflug
>
Dam Son,
You would really benefit yourself by taring your data onto another
drive so you don't have to go through all that again
hard drives are really cheap nowadays, and/or you may already have a
drive that you can dedicate to backups -
ask yourself what your time is worth and where you want to spend it, on
data recovery?
we should learn from our mistakes
peace
paul
_______________________________________________
nflug mailing list
nflug at nflug.org
http://www.nflug.org/mailman/listinfo/nflug
More information about the nflug
mailing list