recovery recommendations
Eric Sandeen
sandeen at redhat.com
Fri Jan 21 19:06:05 UTC 2011
On 1/21/11 12:36 PM, m.p. wrote:
> Recently a 640GB external enclosure was PEBKAC'd with the following
> command:
>
> dd if=/some-185mb-linux-install.iso of=/dev/sdx
>
> [not of=/dev/sdx1]
>
> Since the PEBKAC, the drive has not been written to beyond being
> unplugged. I have made an image of the drive and have attempted to run
> against it: testdisk, fsck.ext3 with alternate superblocks, and even
> "fsck.ext3 -Sy", to no avail.
>
> So. I am *convinced* that my 550gb of data is recoverable. It seems that
> [obviously] the first 185mb is gone - whatever files those were.
You really need to restore from backups. You just overwrote 30% of
your filesystem with something else... you've lost partition data,
metadata, directory data, file data ... whatever was in that first
185M.
I think the best you can do is low-level recovery at this point,
groveling around for file fragments with something like the photo recovery
tools.
> I have googled, but to be honest, I am not entirely sure I'm searching
> the right strings. Most software seems geared towards partition recovery
> where a partition has become damaged [which is technically what's
> happened],
You've done much more than that...
> but not exactly; or partition undeleting [which again isn't
> technically what happened].
>
> Please, any recommendations that don't involve a time machine are much
> appreciated.
Maybe, just -maybe- if you can find a backup superblock, fsck might try
to piece a few things together.
But you can't generally overwrite 1/3 of a filesystem and expect normal
tools to recover for you, I'm afraid.
-Eric
> If this isn't the place to be asking, please point me in the right
> direction.
>
> Thank you.
>
> -mp- - kicking self -
>
>
> _______________________________________________
> Ext3-users mailing list
> Ext3-users at redhat.com
> https://www.redhat.com/mailman/listinfo/ext3-users
More information about the Ext3-users
mailing list