[arch-general] Partition/Data rescue
Hi You know the moment where you would turn back the time some seconds only? Well here we are... I got a perfectly running arch on ssd (6 partitions) and an internal hdd (1partition) with a backup usb disk (1partition) connected at a very genious moment! Having done a SD-multiboot setup with several distros I just wanted to test that the last distro added (DBAN Dariks Boot and nume) boots fine. Only little thing to mention was that --autonuke setting at boot loader. Don't ask me what was riding me, maybe tiredness, stupidness, something evil or altogether! As fast as I swiched the system off it erased at least some sectors on each and every disk! Well, DBAN worked. But how can I get back to something running? At least I would like the backup disk running but I am not sure what is the correct way. I don't have another backup and uploading to Amazon S3 was not yet finished, so disaster recovery would have worked only later.... How I hate Murphy today! For the procedure: Testdisk showed me at least 6 possible partitioning (having had one on this disk!) schemes and just creating the partition with fdisk and not touching the filesystem wouldn't give me my TOC back, no? Using gparted would recreate the filesystem resulting in overwritten data? Do I need to use an ext-restoring rool or what is best to try? First copying the data off to a second external disk with "dd"? And then? I would really appreciate some experienced users feedback as some of the missing data means a lot to me although knowing that there are more important things lime health etc. Thanks in advance! emak
Do not modify data on the disks right now. Make copy with dd (if you have enough space) and do your work on copies. I assume you turned DBAN off asap, I also assume DBAN begins overwriting data on disks from the beginning. First thing I would try to do is to recover mbrs and partition tables. It is safe to assume that your disk with 1 partition had partition that starts at the beginning of the disk. So, create that partition (with fdisk / sfdisk / cfdisk) on your working image. Do not use gparted unless you are sure it won't try to be "helpful" and won't start mkfs right after you created partitions. Now, if DBAN overwrote only beginning of your partition you should be able to restore filesystem's superblock, use fsck and read your data (with broken files in lost+found). I've never done that before, see [1]. For disk with 6 partitions use testdisk to restore mbr and partition table. It probably will not detect first partition, but others should be OK (depends how much DBAN managed to overwrite. I'm afraid with ssd it may be much). Try to fix first partition with fsck ([1]). Also, check photorec. [1] http://linuxexpresso.wordpress.com/2010/03/31/repair-a-broken-ext4-superbloc... -- Krzysztof Warzecha
participants (2)
-
archlinuxmailings@gmail.com
-
Krzysztof Warzecha