[NTLUG:Discuss] Data recovery ideas

[Mike Hart]

Spinrite ( http://www.spinrite.com ) says it supports linux partitions nowdays.  After checking myself, the latest version is 2004 and supports "all linux partition types" as of that date. 

Note spinrite is a boot floppy, it doesn't run in an OS at all. 

I haven't needed to recover crashed partitions since i've been on linux (because I do irregular but frequent backups now.)  Prior to my linux adventures, spinrite recovered everything I threw at it short of no activity on the drive at all.  

There's a good chance if you can see the drive with fdisk, that spinrite will save everything. 


--- On Sat, 2/6/10, Leroy Tennison <leroy_tennison at prodigy.net> wrote:

From: Leroy Tennison <leroy_tennison at prodigy.net>
Subject: [NTLUG:Discuss] Data recovery ideas
To: "NTLUG Discussion List" <discuss at ntlug.org>
Date: Saturday, February 6, 2010, 12:11 PM

Mentioned some time back my hard disk data corruption.  After changing 
motherboards and re-installing I'm cautiously optimistic that I have 
found the problem.  Now it would be nice to recover the data I lost but 
that may not be easy.

e2fsck can't find a superblock (this is ext3) and testdisk doesn't find 
the partition at all even though fdisk and parted see it.  A commercial 
product's (RecoverDataLinuxTrial) trial version did find the partition 
and could see some files in it but didn't find what I was looking for.  
What I would like to do is be able to get to where I could run e2fsck on 
the partition and see what I can find.

Before I give up I would like to try at least a couple more options.  
One I know of is the -S option to mke2fs.  Unfortunately I don't know 
the original block size.  I am thinking of using dd to make a copy of 
the partition to a file and then guess a block size.  If it's wrong then 
restore the partition from the file and guess again.  fdisk reports (the 
drive is a Seagate ):

   Device Boot      Start         End      Blocks   Id  System
/dev/hdc2              27         679     5245222+  83  Linux
                                        or
/dev/hdc2          417690    10908134     5245222+  83  Linux      
(sectors instead of cylinders)
                                        or
Nr AF  Hd Sec  Cyl  Hd Sec  Cyl     Start      Size ID
 2 00   0   1   26 254  63  678     417690   10490445 83            
(extra functionality mode)

for the partition and parted reports:

Number  Start   End     Size    Type      File system  Flags
2      214MB   5585MB  5371MB  primary

Any idea what block size is most likely for a roughly 5GB partition?
Any points to consider when using dd?
Any other ideas?  Amazingly there are other commercial data recovery 
products for Linux but, when I started to download them, they were 
EXEs!  Guess these people assume a dual-boot scenario.

Thanks for any and all help, this has been a real "educational" experience.

_______________________________________________
http://www.ntlug.org/mailman/listinfo/discuss