[NTLUG:Discuss] Data recovery

[Robert Thompson]

 > Good luck and let us know how things go.

I replied but the message bounced while the mail server was down :(

Below is the reply I sent:


 > i forget the name of the util, it's either Disktest or Testdisk.

Thanks for the suggestion. The utility is testdisk. I did a google on it 
and found that it was included in the rescue disc I have (INSERT Linux 
(http://www.inside-security.de/insert_en.html)). That disc also has 
other recovery tools (parted, gpart, partimage, testdisk, recover) that 
came in handy.

I booted off the recovery disc and used testdisk. It found the 
partitions on my other disks but did not list anything for the bad disk. 
The description off the testdisk site says that it can recover lost 
partitions, but I couldn't find how to do that in the sparse manpage 
that was on the rescue disc. I then used another tool on the disc called 
gpart (guess partition) that does a sector by sector scan of the disk 
and reports any possible partition tables it finds. The man pages do say 
that it can find old partitions, so be very careful in trusting what it 
reports. I ran it on the disk using the following:

# gpart /dev/hdf

Luckily it reported only one partition (Primary 1) that was taking up 
the whole disk with the other partitions as unused (Primary 2 - 4). I 
think that's how I partitioned the disk.  Being somewhat confident (okay 
somewhat reckless :) ), I wrote the guessed partition back to disk:

# gpart -W /dev/hdf /dev/hdf

After answering all the questions that gpart asked and completing the 
write, I mounted the disk and it gave no errors. I listed the contents 
of the mounted directory and there were all my backed up files! 5G of 
content saved.

BTW, I did have a backup of the whole 40G disk saved to my 120G drive so 
I was somewhat safe in writing things to the drive. To back it up, I ran 
the following:

# dd if=/dev/hdb of=/mnt/hde/hdb.dd

Note that /dev/hdb is how my OS detects the drive while /dev/hdf above 
is how the rescue disk detected the drive; they are the same disk. After 
a few hours I had a 40G file as a raw backup of the disk. If gpart had 
hosed my disk, I could have restored the drive to try again.

Thanks,

=-= Robert Thompson

Robert Citek wrote:

> 
> On Jun 30, 2005, at 2:34 PM, phrostie wrote:
> 
> 
>> i forget the name of the util, it's either Disktest or Testdisk.
>>
>> it does what you need.
>> been there, done that.
>>
>>
> 
> testdisk.  Another program to look into is gpart.  Both are available  
> on Knoppix 3.8.2.
> 
>   http://knoppix.net/
> 
> But before you use either, you might want to image the drive as a  
> backup.  That way in the off chance that either testdisk or gpart  
> totally hoses your drive, you still have the data to try again.  To  do 
> that, use partimage, also on Knoppix.
> 
> Good luck and let us know how things go.
> 
> Regards,
> - Robert
> http://www.cwelug.org/downloads
> Help others get OpenSource software.  Distribute FLOSS
> for Windows, Linux, *BSD, and MacOS X with BitTorrent
> 
> 
> 
> 
> _______________________________________________
> https://ntlug.org/mailman/listinfo/discuss
> 
>