In article , Eps wrote:
>I have accidentally deleted a partition (NTFS) that had important data
>on it (doh!).

and you can't find the backups Yup - been there.

>What is the best live cd distro for data recovery ?,

It depends on host you deleted the partition. If all you did was remove
the entry from the partition table, just about any distribution (or even
tomsrtbt) can edit the table and allow the correct data to be entered.
The problem with that is that you need to know what the original data
was. If you don't have that data (at home, text copies of the partition
data is copied to other systems AND a real hard copy is in the file
cabinet with the system manuals), then it gets a lot harder. You might
want to look at the Partition-Rescue (mini) HOWTO.

-rw-rw-r-- 1 gferg ldp 24375 Nov 3 2003 Partition-Rescue

>a google search found lots of windows programs that aren't free.

Can't answer for windoze - haven't had it installed since 1992. There
was at one time an application called psniff from Carlos Puchol at Bell
Labs - a perl script that searched the raw disk device looking for e2fs
partitions - you might be able to adopt that.

>Is data recovery a common feature of most linux live distros ?, I think i
>have a copy of knoppix knocking about somewhere.

Not like this. Virtually all distributions have an easy method of reading
the drive directly, but the problem is recognizing the magic signals that
this bit is the beginning of that type of partition.

>any help appreciated.

You're really not looking in the right place. 'comp.os.linux.questions'
has never been a sanctioned newsgroup (see the posting on the 15th of
every month titled 'List of Big Eight Newsgroups' posted to 'news.groups',
'news.announce.newgroups' and 'news.lists.misc'), and I'd really expect
you'd find better luck in a windoze oriented newsgroup.

Old guy

Eps wrote:

> I have accidentally deleted a partition (NTFS) that had important data
> on it (doh!).
>
> What is the best live cd distro for data recovery ?, a google search
> found lots of windows programs that aren't free. Is data recovery a
> common feature of most linux live distros ?, I think i have a copy of
> knoppix knocking about somewhere.
>
> any help appreciated.
>
> --
> Eps


I had this saved from somewhere
(I have never a need to use it yet)...


6. Recovering a Deleted Partition Table
Make a partition that is at least as big as your first partition was. You
can make it larger than the original partition by any amount. If you
underestimate, there will be much wailing and gnashing of teeth.

Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-23361, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-22800, default 22800): 13032

Command (m for help): w

Run dumpe2fs on the first partition and grep out the block count.

Example:

% dumpe2fs /dev/sda1 | grep "Block count:"
Block count: 41270953

If you are uncertain about this value, repeat Step 1 with a bigger
partition size. If the block count changes, then you underestimated the
size of the original partition. Repeat Step 1 until you get a stable block
count.

Remove the partition you just created

Command (m for help): d
Partition number (1-4): 1

Make a new partition with the exact size you got from the block count. Since
you cannot enter block size in fdisk, you need to figure out how many
cylinders to request. Here is the formula:

(number of needed cylinders) = (number of blocks) / (block size)

(block size) = (unit size) / 1024

(unit size) = (number of cylinders) * (number of heads) * (number of
sectors/cylinder) * (number of bytes/sector)

Consider the following example, where a hard drive has been partitioned into
four primary partitions of 1, 2, 4, and 8 cylinders.

disk /dev/sda: 16 heads, 63 sectors, 23361 cylinders
Units = cylinders of 1008 * 512 bytes

Device Boot Start End Blocks Id System
/dev/sda1 1 2 976+ 83 Linux
/dev/sda2 3 5 1512 83 Linux
/dev/sda3 6 10 2520 83 Linux
/dev/sda4 11 19 4536 83 Linux

fdisk provides the configuration information I need in the head of the
output. The unit size is 516096 ( 16 heads * 63 sectors/cyl * 512 bytes
sector ). The block size is 504 ( 516096 / 1024 ). The number of needed
cylinders for the second partition is therefore 3 ( 1512 blocks / 504 ).
The partition table shows that this is indeed the case: the first cylinder
is 3, the second 4, and the last is 5, for a total of three cylinders. The
number of needed cylinders for the third partition is calculated similarly:
2520 blocks / 504 = 5, which corresponds to blocks 6,7,8,9,10 . Notice that
this calculation does not work for the first partition because the block
count is wrong ( 976 instead of 1008 ). The plus sign indicates that not
all the blocks are included in the fdisk value. When you try the
calculation ( 976 / 504 ) you get 1.937. Knowing that the number of
cylinders must be an integer, you can simply round up.

Run e2fsck on it to verify that you can read the new partition.


Repeat Steps 1-5 on remaining partitions.

Remount your partitions. Amazingly, all of your data will be there.

Credit goes to:
Mike Vevea, jedi sys admin and MGH's finest, for giving me these tips.