[Solved] Accidentally reformatted linux partition and worse installed new system

[wedgetail]

Whoever has done this knows what it feels like.

Unfortunately I did have about 6 years of collected information so I will have a look and see what is left. I wish that I had taken some time and used the konsole to reformat as I should have noticed the label. I mistook two similar sized partitions and picked the wrong one.

1.. I was going to test XFCE and knowing I had plenty of room on a 200GB internald hard drive partition, I charged ahead, forgetting to turn off/remove my external USB drive. Long and short the 200GB partition on the USB drive was reformatted and XFCE installed. When I had finished my cooffe waiting, the gears started creaking and I backtracked a bit an was stunned discovering the partition I had remodelled.

2.. I have not written to the partition since I beleive. The XFCE partition used is about 11GB out of the 200GB so my thinking is that a lot has disappeared but there may be something to rescue.  I am not too bad working down at this level in Windows but I am a bit lost in Linux so it is time to learn. The partition unfortunately was Data only.

3.. On the net I discovered R-Linux which to my joy  is similar to Winhex which I own and perhaps even could use but R-Linux works on the ext... formats and the host MS Windows, as I happen to have XP on this machine I have R-Linux up and running.  I have created and image of the remodelled partition and use this to work upon learning to drive R-Linux.  The image took 4 hours to created!!!

4.. I have attempted to recover by extension .html files as I know there are some and I have got lots, but they seem to just have a sequence number.  I have stopped at this stage as I am curious about the how these ext's formats work.

5.. I see lots of inodes beyond the XFCE filesystem (with big red x in front), which of course by the way looks like the perfect Linux file system layout.

I am curious about Master Boot Record, Partition Boot Records and File Allocation Tables in MS system I sort of know where they sit with respect to  sectors/tracks.  

1.. Some recovery would be nice but if not possible so be it
2.. Like to take the opprtunity to learn more about the partition formatting and layout

I have spent about 3 hours reading through some of old-polack's with great delight, there is so much to be learnt here.  Actually quite a few of the topics where he has been involved with 'bad' cases were on this remodelled partition. I will continue with those but in the mean time start the thread.

   Any suggestions

[wayne1932]

All I can do for you is offer my sympathy.   I don't have a clue as to what might be recoverable. 

Good Luck

[Old-Polack]

wedgeling:

The biggest problem with recovering files from borked partitions is they usually don't have their proper file names anymore, as you are seeing with the .html files. If they are intact, they will open and you can view their contents, then rename them back to the original name, or something at least suitable.

When you say R-Linux is like Winhex, does that mean it contains a hex editor, as well as a recovery application? Hex editors can be handy for identifying some of the trickier recovered files.

You may even be able to recover some files from the new partition, as files tend to be installed from the front of the file system toward the end. The empty space after the newly installed files may still have some of your old files in a recoverable state, underneath. I'd run photorec on that new partition first to see what might still be recoverable in there. You'll have to have some blank space on another partition to create a directory to hold the recovered files.

[smcs_steve]

I recommend chanting (It won't work, but may distract you from the pain!)

My sincere sympathy for your lost quality time.
>>Steve

[wedgetail]

furphy / wayne1932
Thank you both, I appreciate your comments, while it does not help with details it supports my determination to learn something from this deplorable action on my part. I really did not think I could do that sort any more so in a way I think I am being taught a lesson.

As a small consolation old-polack some months ago, back in my last winter, patiently taught me some use of rsync from terminal:

Code: [Select]

[root@localhost gert]# rsync -h
rsync  version 3.0.7  protocol version 30
Copyright (C) 1996-2009 by Andrew Tridgell, Wayne Davison, and others.
Web site: http://rsync.samba.org/


rsync is a file transfer program capable of efficient remote update via a fast differencing algorithm.

The exercise went as far as transferring my then PCLOS2009 system to the same USB hard drive but another partition so some of my recent data, not a lot, can be recovered from there. (Only a couple of weeks ago did I manage to destroy that system completely and decided to change to fresh start on PCLOS 2010, so I was doing too much new stuff when this happened)

Anyway I am starting to come out of the daze and try to think more proper again.  The more I think about what I have read about rescue in this forum and other places the panic is starting to settle. It may be Linux formatted but still MBR, Partition Table,  4 Primary Partitions max and use of Extended Partitions, so it is starting to sound like good old DOS stuff.  

old-polack
File names, that was what I was afraid of hearing. When I had done the first file recovery I started to realise that the file might be html but no names allocated, missing file allocation table?. Not surprising if that is found in the first cylinder? Then of course most likely not there anymore.

R-Linux looks great, if you know Winhex it will do similar things ie it would recover all jpg if any but on this partition I don't think I would have many.  R-Linux has built in hex editor no problem doing great grief on an original drive/partition, knowing myself and keenness to push buttons I made the image, also to force myself to take time out, though I was not quite thinking 4 hours at the time. I am very new to the R-Linux, would be advisable I read a bit more in the manual and not assume knowledge I have from Winhex.

Phtorec, I have some time ago tried something that would recover photos from SD Cards, some of our Digital Photos got stuck.  I will look it up as I have seen it mentioned a few times here in Forum.

Yes it is in the empty space I am rummaging around.

Where does Linux place Partition Tables and File Allocation Tables, depending on Windows version I think there are "backups" like on Win2000 I think towards the end of a Partition is help to be had. My thinking is that since I was using the whole partition previously the new partition is much shorter that out in the empty part there may be tables related to the previous partition.

About the recovery space, this is also problematic as I do not at this time have another 500 or 1000GB disk for recovery use, however that is just a matter of ordering or I could be ruthless and take a 1GB hardly used SATA out of an XP machine. (Just thought of that)

Yes the panic is subsiding.  

[Old-Polack]

wedgeling:

No file allocation tables in Linux, but there are backup superblocks. Depending on the size of the partition, if all other settings are the defaults, they are in the following locations, in relation to the start of the partition. Testdisk uses the information on these to recover partitions, and photorec uses them to help locate whatever files are still recoverable.

Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000, 7962624, 11239424, 20480000, 23887872

It may be possible for testdisk to recover the old partition, and your files may then still be intact, and visible, complete with file names. It would be worth trying. You'd lose the new install, but regain at least part of your data, in a usable state. If it works, I'd move it off of that partition as soon as possible, in some form of backup.

[ezas]

You have my sympathy . .

In a shameless bid for ignominy - I lost FIFTEEN years of data going back to the days of DOS 3.3. Just about every file I ever created on a computer. Every file from six years of computer major school work, every letter, various work projects, files from home design software, every saved poem, dear John letter, etc. Im not a big picture person but I did lose all the pictures of my customized Yamaha Warrior motorcycle that I did all the work on. Tax files were no big concern, hard copies of all returns. Music didn't bother me too much I only have about 120 CD's so it's not that much to re-rip/encode them, and I've only bought two CD online for download.

A lot of it was chaff, but I actually really don't have a concept of what I lost. There was just too much, folders in folders containing zip files in zip files of hardrives copied from an old computer to a new computer more times than I can count (I probably average about one new computer every 18 months.)

Luckily I found my resume in an old email. Whew!  That would have been hard to recreate 25 years of work experience.

About a year ago I was playing with Distros and forgot that my Winders had a Data D: drive. I formatted the partition after the Winders partition and didn't realize it for a month. I had a more recent doc's in My Documents on the C: drive but most of it was of no importance.

Learned my lesson and now I back up to datastorageunit.com.

I hope you have some luck restoring some of your data. I didn't even try after how many distros I had installed and deleted and installed again.

[wedgetail]

ezas
Thank you, what can I say.

old-polack
I have just had a look at superblocks, I am reading up a bit on those here

http://www.cyberciti.biz/tips/understanding-unixlinux-file-system-part-i.html

I have run following on the original drive

Code: [Select]

[root@localhost gert]# dumpe2fs /dev/sdb1|grep -i superblock
dumpe2fs 1.41.12 (17-May-2010)
  Primary superblock at 0, Group descriptors at 1-13
  Backup superblock at 32768, Group descriptors at 32769-32781
  Backup superblock at 98304, Group descriptors at 98305-98317
  Backup superblock at 163840, Group descriptors at 163841-163853
  Backup superblock at 229376, Group descriptors at 229377-229389
  Backup superblock at 294912, Group descriptors at 294913-294925
  Backup superblock at 819200, Group descriptors at 819201-819213
  Backup superblock at 884736, Group descriptors at 884737-884749
  Backup superblock at 1605632, Group descriptors at 1605633-1605645
  Backup superblock at 2654208, Group descriptors at 2654209-2654221
  Backup superblock at 4096000, Group descriptors at 4096001-4096013
  Backup superblock at 7962624, Group descriptors at 7962625-7962637
  Backup superblock at 11239424, Group descriptors at 11239425-11239437
  Backup superblock at 20480000, Group descriptors at 20480001-20480013
  Backup superblock at 23887872, Group descriptors at 23887873-23887885
[root@localhost gert]#

For the uninitiated don't just copy this, I don't know what I am doing, my fingers again ahead of my brain. I have a vague idea that I have found the superblocks on my re-modelled hard drive, which now is 11GB in size. I am hoping these backup superblock blocks contain information regarding the previous formatting of the partition. Fingers crossed. 

What I can do with them is still veiled in fog. old-polack indicated these could be used by testdisk and photorec

I have now allready downloaded photrec which was in repository, and I havd just discovered that testdisk is already installed.

Hmmmm what now?  Better go read about testdisk, man testdisk this did no good, no manual but testdisk -h obligded information enough to get information from /dev/sdb

Code: [Select]

[root@localhost gert]# testdisk /list /log
TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
Please wait...
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63, sector size=512
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63, sector size=512

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition                  Start        End    Size in sectors
 1 * HPFS - NTFS              0   1  1  4461 254 63   71681967
 2 P Linux                 4462   0  1  8109 254 63   58605120 [LXDE]
 3 P Linux                 8110   0  1 11757 254 63   58605120 [PCLOS2010]
 4 E extended             11758   0  1 77536 254 63 1056739635
 5 L HPFS - NTFS          11758   1  1 75498 254 63 1023999102 [500GB]
   X extended             75499   0  1 76007 254 63    8177085
 6 L Linux Swap           75499   1  1 76007 254 63    8177022
   X extended             76008   0  1 77536 254 63   24563385
 7 L Linux                76008   1  1 77536 254 63   24563322 [XFCE]
Disk /dev/sdb - 500 GB / 465 GiB - CHS 60801 255 63
     Partition                  Start        End    Size in sectors
 1 * Linux                    0   1  1 26499 254 63  425722437 [USB465-1B]
 2 P Linux                26500   0  1 30323 254 63   61432560 [USB465-2B]
 3 P Linux                30324   0  1 34240 254 63   62926605 [USB465-3B]
 4 E extended             34241   0  1 60800 254 63  426686400
 5 L Linux                34241   1  1 35808 254 63   25189857 [USB465-5B]
   X extended             35809   0  1 36317 254 63    8177085
 6 L Linux Swap           35809   1  1 36317 254 63    8177022
   X extended             36318   0  1 60800 254 63  393319395
 7 L Linux                36318   1  1 60800 254 63  393319332
[root@localhost gert]#

I left the /dev/sda in the listing though I was tempted to trim it out, but better not.

[USB465-1B] this is the label given to /dev/sdb1 this is the one I am working upon. Actually XFCE is installed here (but never tried to run it as I discovered the accident)

I will take time out and do some thinking, as it is not clear to me if I can use testdisk to use backup superblock to reset formatting?

Summary: I seem to have backup superblocks, what do they refer to, present format or previous?  Can one read contents of superblocks?     

[wedgetail]

ongoto
Thank you for your comment. I suspected something like this when I saw my first attpempt using R-Linux and am not relishing the idea.  Therefore I am trying to find the "hidden" file information and somehow recontruct many parts of the old stucture, also as a learning exercise.  Taking your time I believe will give you good success and I hope you may arrive at satisfaction in the end.

[Was_Just19]

The less actions are performed on the original the more chance you have of successfully recovering the available data.

I would be inclined to make a 'copy' of the free space on the partition, and then run photorec on that .......  before doing any changing of partitions with testdisk.

Yes you are going to need lots of disk space ......  no way of avoiding it.

If you take it slow and careful ........  working ONLY on copies ........  you might be surprised what you will recover - hopefully pleasantly surprised!

good luck 

[wedgetail]

JohnBoy
Hmmm, I broke the rule a little while ago. I just had to do some reads from the drive. Like getting the superblock listing. Then there was just that little thing too ........ naaah I had better look for that hard disk.

If I have another drive I guess there a simple way to just make and identical copy, I seem to remember from MS that I played around with something dd, but I am a bit ahead of myself here again. I have just found something on the net about the structure, exactly what I was looking for so I must read that just for education.  For anybody interested, but more as record for myself as I will be keeping a copy of this topic (just so I can loose it again in the future  )

http://tldp.org/LDP/tlk/fs/filesystem.html

[Old-Polack]

wedgeling:

Absolutely nothing more boring than reading about file system structures... until it's your file system that's screwed. Amazing how interesting it then becomes, isn't it? 

I'll bet you'd never guess how it came about that I started reading the very item you linked to, quite a few years ago. 

[AndrzejL]

Dude... All I can say:

1) Listen to Old-Polack
2) Back Up the data...
3) Back Up the data...
4) Back Up the data...
5) Back Up the data...
6) Make exstra backup of data...
7) Did I mentioned to Back Up the data...

Hope You will get it back. Reading the thread and holding the fingers crossed.

Andy

[wedgetail]

AndrzejL
Thank you and have no fear when old-polack  says something I turn it over twice to make sure I understand. I learnt about rsync, but not finished yet. Then 2010 got in the way as well as summer when I decided it is time to be outside not in front of a computer for hours.  Now winter is arriving I had a crash start on 2010, I had seen old-polack had changed too so that was good enough for me when my 2009 version crashed rather spectacularly (I really wonder who could have done that). I made a vane attempt to recover but there really was no point, even for my curiosity. I absolutely love PCLOS 2010 now I have it working mode.  I just got carried away trying to help somebody and my focus slipped for a minute.

old-polack
 When you put it that way    
I have been meaning to for a long time to do something, well now I certainly am doing something.  

I have read quickly the whole linked article, studied a bit closer about inodes (one for each file on a system) and superblocks, not quite sure if the superblocks are all the same or only covering a group or area of the disk, ie is the primary superblock zero containing the same info as superblock n. Having seen some of the topics where you have talked about superblocks to be checked I have assumed they are the same and added as the partition is swallowed up. I am probably on dangerous ground here with my assumptions, so back to reading.

Would be very easily solved going to R-Linux but then I have to reboot into XP that does not 'seem' right. So I will chase up a way of reading a superblock in Linux first. A thought occurred , could one dd -> one superblock to a file, then read with nano but dd works on sectors hmmmmm better go checking some man dd, well no man entry. dd --help but a bit scary. This would probably be hex and need decoding, hmmmmmm.  

Edit:
I need to read this one for me some great clarifications and links
http://wiki.archlinux.org/index.php/File_Recovery

[Was_Just19]

Some reading for you

http://www.linuxquestions.org/questions/showthread.php?t=362506

http://www.linuxquestions.org/linux/answers/Applications_GUI_Multimedia/How_To_Do_Eveything_With_DD

http://www.softpanorama.org/Tools/dd.shtml

regards.