best live cd for data recovery ? - Questions

This is a discussion on best live cd for data recovery ? - Questions ; I have accidentally deleted a partition (NTFS) that had important data on it (doh!). What is the best live cd distro for data recovery ?, a google search found lots of windows programs that aren't free. Is data recovery a ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: best live cd for data recovery ?

  1. best live cd for data recovery ?

    I have accidentally deleted a partition (NTFS) that had important data
    on it (doh!).

    What is the best live cd distro for data recovery ?, a google search
    found lots of windows programs that aren't free. Is data recovery a
    common feature of most linux live distros ?, I think i have a copy of
    knoppix knocking about somewhere.

    any help appreciated.

    --
    Eps

  2. Re: best live cd for data recovery ?

    In article , Eps wrote:
    >I have accidentally deleted a partition (NTFS) that had important data
    >on it (doh!).


    and you can't find the backups Yup - been there.

    >What is the best live cd distro for data recovery ?,


    It depends on host you deleted the partition. If all you did was remove
    the entry from the partition table, just about any distribution (or even
    tomsrtbt) can edit the table and allow the correct data to be entered.
    The problem with that is that you need to know what the original data
    was. If you don't have that data (at home, text copies of the partition
    data is copied to other systems AND a real hard copy is in the file
    cabinet with the system manuals), then it gets a lot harder. You might
    want to look at the Partition-Rescue (mini) HOWTO.

    -rw-rw-r-- 1 gferg ldp 24375 Nov 3 2003 Partition-Rescue

    >a google search found lots of windows programs that aren't free.


    Can't answer for windoze - haven't had it installed since 1992. There
    was at one time an application called psniff from Carlos Puchol at Bell
    Labs - a perl script that searched the raw disk device looking for e2fs
    partitions - you might be able to adopt that.

    >Is data recovery a common feature of most linux live distros ?, I think i
    >have a copy of knoppix knocking about somewhere.


    Not like this. Virtually all distributions have an easy method of reading
    the drive directly, but the problem is recognizing the magic signals that
    this bit is the beginning of that type of partition.

    >any help appreciated.


    You're really not looking in the right place. 'comp.os.linux.questions'
    has never been a sanctioned newsgroup (see the posting on the 15th of
    every month titled 'List of Big Eight Newsgroups' posted to 'news.groups',
    'news.announce.newgroups' and 'news.lists.misc'), and I'd really expect
    you'd find better luck in a windoze oriented newsgroup.

    Old guy


  3. Re: best live cd for data recovery ?

    Eps wrote:

    > I have accidentally deleted a partition (NTFS) that had important data
    > on it (doh!).
    >
    > What is the best live cd distro for data recovery ?, a google search
    > found lots of windows programs that aren't free. Is data recovery a
    > common feature of most linux live distros ?, I think i have a copy of
    > knoppix knocking about somewhere.
    >
    > any help appreciated.
    >
    > --
    > Eps



    I had this saved from somewhere
    (I have never a need to use it yet)...


    6. Recovering a Deleted Partition Table
    Make a partition that is at least as big as your first partition was. You
    can make it larger than the original partition by any amount. If you
    underestimate, there will be much wailing and gnashing of teeth.

    Command (m for help): n
    Command action
    e extended
    p primary partition (1-4)
    p
    Partition number (1-4): 1
    First cylinder (1-23361, default 1):
    Using default value 1
    Last cylinder or +size or +sizeM or +sizeK (1-22800, default 22800): 13032

    Command (m for help): w

    Run dumpe2fs on the first partition and grep out the block count.

    Example:

    % dumpe2fs /dev/sda1 | grep "Block count:"
    Block count: 41270953

    If you are uncertain about this value, repeat Step 1 with a bigger
    partition size. If the block count changes, then you underestimated the
    size of the original partition. Repeat Step 1 until you get a stable block
    count.

    Remove the partition you just created

    Command (m for help): d
    Partition number (1-4): 1

    Make a new partition with the exact size you got from the block count. Since
    you cannot enter block size in fdisk, you need to figure out how many
    cylinders to request. Here is the formula:

    (number of needed cylinders) = (number of blocks) / (block size)

    (block size) = (unit size) / 1024

    (unit size) = (number of cylinders) * (number of heads) * (number of
    sectors/cylinder) * (number of bytes/sector)

    Consider the following example, where a hard drive has been partitioned into
    four primary partitions of 1, 2, 4, and 8 cylinders.

    disk /dev/sda: 16 heads, 63 sectors, 23361 cylinders
    Units = cylinders of 1008 * 512 bytes

    Device Boot Start End Blocks Id System
    /dev/sda1 1 2 976+ 83 Linux
    /dev/sda2 3 5 1512 83 Linux
    /dev/sda3 6 10 2520 83 Linux
    /dev/sda4 11 19 4536 83 Linux

    fdisk provides the configuration information I need in the head of the
    output. The unit size is 516096 ( 16 heads * 63 sectors/cyl * 512 bytes
    sector ). The block size is 504 ( 516096 / 1024 ). The number of needed
    cylinders for the second partition is therefore 3 ( 1512 blocks / 504 ).
    The partition table shows that this is indeed the case: the first cylinder
    is 3, the second 4, and the last is 5, for a total of three cylinders. The
    number of needed cylinders for the third partition is calculated similarly:
    2520 blocks / 504 = 5, which corresponds to blocks 6,7,8,9,10 . Notice that
    this calculation does not work for the first partition because the block
    count is wrong ( 976 instead of 1008 ). The plus sign indicates that not
    all the blocks are included in the fdisk value. When you try the
    calculation ( 976 / 504 ) you get 1.937. Knowing that the number of
    cylinders must be an integer, you can simply round up.

    Run e2fsck on it to verify that you can read the new partition.


    Repeat Steps 1-5 on remaining partitions.

    Remount your partitions. Amazingly, all of your data will be there.

    Credit goes to:
    Mike Vevea, jedi sys admin and MGH's finest, for giving me these tips.


+ Reply to Thread