Reformatted important partition, how can I recover

[wedgetail]

Seems I have received a late Christmas present in the form of a nudge to fix up my hard drive problem. I have just installed another instance of PCLOS and decided to do a step by step proper record as I solved a mystery to me when installing the old-polack way.

I was a bit careless and managed to reformat my 'workhorse' partition. I did not expect the step to take off on me but it did. I work in small single partition installs, ie multi Linux systems on a 1GB drive, only one swap file plus XP and one NTFS data partition.

Code: [Select]

[root@localhost gert]# fdisk -l

Disk /dev/sda: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders, total 1953525168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x8a208a20

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63    71682029    35840983+   7  HPFS/NTFS
/dev/sda2        71682030   130287149    29302560   83  Linux
/dev/sda3       130287150   188892269    29302560   83  Linux   <--------------------- this 30 GB partition now 'empty'
/dev/sda4       188892270  1495217744   653162737+   5  Extended
/dev/sda5       188892333  1212891434   511999551    7  HPFS/NTFS
/dev/sda6      1212891498  1221068519     4088511   82  Linux swap / Solaris
/dev/sda7      1221068583  1245631904    12281661   83  Linux
/dev/sda8      1245631968  1294453439    24410736   83  Linux
/dev/sda9      1294453503  1333523519    19535008+  83  Linux
/dev/sda10     1333523583  1382345054    24410736   83  Linux
/dev/sda11     1382345118  1421399069    19526976   83  Linux
/dev/sda12     1421401118  1463344157    20971520   83  Linux
/dev/sda13     1463346206  1495217744    15935769+  83  Linux


Since I have not done anything else than dd the content to my USB hard drive as precaution, this should be a simple recovery exercise, or so I thought.

Code: [Select]

[root@localhost gert]# dd if=/dev/sda3 of=/dev/sdb7 bs=4096 conv=notrunc,noerror
7325640+0 records in
7325640+0 records out
30005821440 bytes (30 GB) copied, 946.55 s, 31.7 MB/s
[root@localhost gert]#
Question: Using Testdisk which already seems installed, this should be easy to recover  

Can I do the recovery on the copy on the USB drive?

I am using as starting point some pointers from one of my own serious 'accidents' not that long ago.

http://www.pclinuxos.com/forum/index.php/topic,75207.0.html

Where I have the general idea trying to recover via the use of superblocks, more later as I am trying to get my head around at what time that is appropriate way to go.

Edit:
I like to prepare my partitions manually before installing Linux from LiveCD. I don't know quite why I find the automated partition management confusing but it has caused me harm a number of times, even having read old-polack's preference to turn off formatting.

Suddenly it dawned on me that the tick needed to be removed when asking "format selected partition" when this gave success I decided to carefully write down the instructions.  In order to "get it right" I went through every install step not paying attention to what partition was selected.

I thought it was right here that I hit the "next" button and it started formatting, realising something was wrong I canceled perhaps after 3 seconds.

The partition does not automount. Only when called from boot stanza or mounted by Dolphin. I started looking for place to make a copy and started up this thread. Initially thinking it would only be a nusence but I would recover.

[ongoto]

Sorry to hear the bad news wedgetail.  
There have been others on the forum here who have reconstructed their partition table.  The data should all still be there on the HD.

[wedgetail]

ongoto
I am still in good spirit as I have not installed anything on top, yet. Trying not to let my fingers go it alone without backup from the brain. I should have records of a number of recovery situations in my notes, which I am trying to sort out. 

[Was_Just19]

ongoto
I am still in good spirit as I have not installed anything on top, yet. Trying not to let my fingers go it alone without backup from the brain. I should have records of a number of recovery situations in my notes, which I am trying to sort out. 

Try to ensure that the partition in question does not get mounted by anything in the meantime ......  to preserve the contents.

So sda3 has been changed .......  from what? Using what app?

Work on the copy only .....  preserve the original as is until you are satisfied the copy is good enough in the event of losing the original.

regards.

[wedgetail]

Just19
LiveUSB installer, was checking the sequence and got to stage where it said 'formatting' (unfortunately /dev/sda3)

Trying to leave the partition reasonably alone, just doing dd to the USB hard drive or other mass storage.

Understand your warning, probably should set partition read only if I knew how  

[ongoto]

http://www.pclinuxos.com/forum/index.php/topic,77463.0.html

I don't know if you lost your notes or what, but a search for testdisk by Old-Polack turned up quite a bit.  I'm sure O-P will find this thread soon as he gets back online and jump on in.

You would set read only when you mount the partition.
In /etc/fstab you can edit the line that mounts the partition and insert ro in there.
/mnt/win_e ntfs-3g user,exec,ro,auto,nls=utf8,umask=000 0 0
 

You can also do it at the command line.  Try something like this (I'm reasonably sure)
mount -o ro /dev/sda3 /mnt/sda3
cat /etc/mtab just to see if it worked.

[Xero]

In the past, I have accidentally re-formatted a 1TB ext3 partition to NTFS (full-format) and did not realise was wrong one til later. I was very tired when did this, bad mistake. Searched and searched, finally decided nothing to lose, pointed testdisk at it, and it completely restored all my data and the ext3 partition. Took a lot of time, but I got it ALL back. 

[wedgetail]

ongoto
I get a bit sidetracked when I start looking for old records, I will experiment with your:

You can also do it at the command line.  Try something like this (I'm reasonably sure)
mount -o ro /dev/sda3 /mnt/sda3
cat /etc/mtab just to see if it worked.

My fstab is in a sorry state, since Dolphin seems to handle my drive management well I have been very slack on fstab.

Xero
Finally I am getting stuck into Testdisk, running it presently but I have better find some manual as it does not seem to be revealing expected result on quick scanning.  I have done one deep scan which I think I misinterpreted so I am doing it again. So long ago I  used it I have forgotten what to expect.

[Xero]

I forge the details (been a while), but basically had it scan for traces of the previous partition, and when it found an ext3 , told it to recover it. That was basically it. Bit more detail in the doing, but overall about it.

[wedgetail]

Xero
I have aquainted myself with testdisk again and I think I understand the options. Like you I had forgotten how I used it last time. I can not make head or tail what I am up against right now.  I am starting up a new hard drive but struggling to make it do what I expect.  I will have to get that sorted first now.

I have managed a number of Deep Scan runs, not looking good. I always seem to come up with empty partition (lost and found) only content.

[T6]

if the partition can't be recovered, i would recommend to use photorec to recover the files

the names of the files will be lost but it surely will save some of the files

be sure to have a extra hard disk to store the files recovered

[wedgetail]

T6
Thanks for info.
I like to run a mile when I hear about Photorec, having some unsuccessful experience due to the name problem.  
However it is a possibility but I need to figure more details about the mishap as the post mortem is not shaping up as I thought it would.
Hard disk space is not a problem right now, got a couple of 1TB drives 14 days ago.

[Xero]

Xero
I have aquainted myself with testdisk again and I think I understand the options. Like you I had forgotten how I used it last time. I can not make head or tail what I am up against right now.  I am starting up a new hard drive but struggling to make it do what I expect.  I will have to get that sorted first now.

I have managed a number of Deep Scan runs, not looking good. I always seem to come up with empty partition (lost and found) only content.

Oh Oh oh, that rings a bell. Yes, I remember now. I had that happen, thought it failed, but all of my missing things were actually found in the "lost and found" folder. Never occurred to me, til I checked free space, and wondered why so much was used. .  Have a look, you might be surprised.

[wedgetail]

Xero
Believe it or not, I had the mouse posed over Lost and found at 4 AM but a bit dispirited so I left it. Not sure I dare look  . I am just recovering from suspecting a completely new drive playing foul on me. Pheeew, seems it is ok (the other thread) and learnt something new.

When you say look, do you mean using testdisk, my mind is sort of struggling as I am also attacking with some unmentionable OS that can run something called R-Linux.

[Xero]

No, just look inside the folder with your file manager, and with luck, all your files and folders will be inside it. Forgot this little detail til you jogged my memory.