Hello m.p.
On Friday 21 January 2011 19:36:41 m.p. wrote:
> Recently a 640GB external enclosure was PEBKAC'd with the following
> command:
A short time ago I overwrote the first 12GB of my single-disk 1TB system. Thise
12GB luckily contained only OS files I was about to replace anyway (still gotta
write that up as solved; see the archives for "Overwritten beginning of ext3
filesystem. Recovery?" on 27dec2010). I got all my important user data back in
one piece.
Depending on usage patterns and the kind of data you had on that disk, I think
your chances are pretty good to get most of it back.
> So. I am *convinced* that my 550gb of data is recoverable. It seems that
> [obviously] the first 185mb is gone - whatever files those were.
In my case, I overwrote an ext3 partition's first few GB with a valid ext3 FS
of identical size but different content. fsck then found lots of errors (in the
"overlaying" FS) due to it being incomplete. The problems were so bad that it
never actually got to recovering the good ("underlaying") data.
What did the trick for me was to zero out the offending stuff. In your case that
would be sth. like:
* Keep a copy of your "unrecovered" disk image! You don't want to touch the
original disk at all, so be prepared for making mistakes
* dd if=/dev/zero of=PARTIMAGE count=ISOSIZE
where ISOSIZE is the ISO image's size in bytes
* Extract the partition image like Alex Bligh wrote and work with that
* e2fsck -f -y /dev/sdx1 (perhaps -b and -C0 as well)
e2fsck will probably ask you to be run again (might want do that anyway to
make sure)
You'll then find the remainder of your data in lost+found/, even most directory
hierarchies will be intact. Some pretty much random(!) data blocks from
seemingly anywhere(!) on disk will be zeroed out, but at least those will be
easily recognizable. The exact outcome depends on what data you had on there,
as well as usage scenario and history.
It's imperative that you check every file of the results - any data block might
be missing, any subdirectory might be missing. If you lost a directory entry,
chances are high that it's contents will show up directly (and namelessly) in
lost+found/.
Hope that helps. If you find the time, please keep me posted about your
results.
--
With best regards,
Florian Weber
_______________________________________________
Ext3-users mailing list
Ext3-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/ext3-users
