CentOS - Jun 2007 - Retrive data from repartitioned / reformatted, hard drive?

"Mark Hull-Richter" <mhullrich at gmail.com> wrote:
> On 6/28/07, Niki Kovacs <contact at kikinovak.net> wrote:
>   
>> > Hi,
>> >
>> > The title says it all. One of my clients showed me a 120 GB hard
drive
>> > that his daughter accidentally formatted, according to him. I
booted the
>> > first CD I had at hand - a Slackware 11.0 install CD - and
launched
>> > cdfdisk /dev/hda. cfdisk informed me that there was even no
partition
>> > table. So much for reformatting. cfdisk only shows me 120 GB of
free space.
>> >
>> > Any way to retrive data on this hard drive? Some magic live
distribution
>> > to read data on repartitioned / reformatted hard drives? any
suggestions?
>> >
>>     
>
> If it was actually reformatted, you'll have to go to one of the data
> recovery services - getting at data buried under a true reformat
> requires some seriously expensive and high-tech equipment.
>
> If it was just repartitioned, you might be able to recover the data
> using one of several less (but still) expensive data recovery tools
> that are available on the market.  If you work for any IT company, see
> if your systems administration / MIS / IT group has something like
> that (or just ask around) - many do.
>
> When I worked at Quest Software, the MIS department had these for the
> occasional disk crash data recovery, and I was lucky enough to get one
> of my partitions back that way, although four files (out of hundreds)
> were still damaged and so far unusable.
>
> Good luck.
If you just want to confirm that some data is still there, you might try 
something like:

1) Boot from any Linux live CD (knoppix, Fedora 7, etc.).
2) Open a command window.
3) Assuming this is the only hard drive and it's /dev/hda:

dd if=/dev/hda | grep 'some *short* string that should be present'

4) If your string survived, you should see something like "binary file 
matches'.

On my laptop (dual boot to XP home or CentOS5) I see:

[root at spindle ~]# dd if=/dev/hda | grep -i dos
Binary file (standard input) matches

Alternatively, there are some disk editors for Linux.  Google turned up 
LDE which claims to mimic the old "Norton Disk Editor."  If you go
this
route, you would probably do better sticking the drive into a Linux 
system although you might be able to find someone who has set up a Linux 
recovery live CD that includes LDE.  I haven't used LDE but the old 
Norton tool was pretty amazing.

Any idea what file system was on the disk originally (vfat, ntfs, ext3, 
etc.)?

Cheers,
Dave

-- 
Politics, n. Strife of interests masquerading as a contest of principles.
-- Ambrose Bierce

David G. Miller wrote:
> If you just want to confirm that some data is still there, you might try 
> something like:
> 
> 1) Boot from any Linux live CD (knoppix, Fedora 7, etc.).
> 2) Open a command window.
> 3) Assuming this is the only hard drive and it's /dev/hda:
> 
> dd if=/dev/hda | grep 'some *short* string that should be present'
> 
> 4) If your string survived, you should see something like "binary file
> matches'.
I wonder how difficult it would be to recognize a BR? Each logical
volume (nothing to do with LVM) should have a BR on its first
sector.

Mike
-- 
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
Oppose globalization and One World Governments like the UN.
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!