[NTLUG:Discuss] Lost partitions, mount points, data????

[kbrannen@gte.net]

clayton.c.miller wrote:
...
> 
> Now, in my ignorance I said "y" to all questions.  Of course as it turned out, I lost ALL my data.  After reading some more I realize I should have answered no to clearing the "inodes".  I did find some numbered folders in the "lost+found" folder.  They do not contain information.   I have not touched them.
> 

Bummer!  I hope that you've mounted the drive Read-Only, so has not to disturb 
anything.  Or else you haven't mounted it have been looking at it raw with 
some tool (e.g. debugfs).

> Will any of the recover or undelete tools help me regain the files?
 >  Will the undelete how-to be of any help?

Don't know, but it probably won't hurt to try.

 >   Is there any other help or advise you can give?

A few ideas:

* if the data is <really> important, there are data recovery services who do 
this all the time and will probably do a better and faster job of recovering 
the data.

* before you do anything else, make a backup of the drive and use that to work 
on if you can.  (if forced to, do:  dd if=/dev/hda2 of=/tmp/bad_drive bs=4096 
bc=XXX ; where hda2 is the lost partition, and XXX is the number of blocks in 
the partition)

* if your data is ASCII text, you can just dump the partition to a file (see 
above), then do a "strings" on it and finally rearrange it's output so it's 
what you want.  This does assume you can recognize your data. :-)

* similar to the previous one, you can research the size of the partition 
header, skip that far into the file (partition), then start pulling off chunks 
of 4096 bytes (probably, but you really need to know how your partition was 
created, but 4096 is the usual default for ext2 :-) and store those to 
individual files and do your string searches on those.  Be sure to skip the 
blocks with the alternate superblocks.  This is analogous to having a string 
of pearls that were on the string in size order, then having the string break, 
and having to pick the pearls up off the floor (which are all over the place) 
in the correct order.  (I did this for a company once, but didn't recover 
enough data to make it worthwhile, i.e. after working on it for about 10 hours 
I extrapolated how long it would take to do the entire 1G drive and they 
determined the data wasn't worth that much. :-)

Again, if the data is important and you need it soon, you should consider 
having a company that specializes in this do it for you.  OTOH, if you 
consider this an education experience, then have fun. :-)

HTH,
Kevin