Manfred Heubach wrote:
Hello, I've accidently used mkfs.ext3 on the wrong harddisk (used hdb3 instead of hda3). Is there any way to recover the files on this partition? There is no backup copy of this partition. If it is not possible to recover the files or filesystemstructure maybe it's possible to extract some files from the raw device. Except of running mkfs no data has been written to that disk. I had 5 zipped tar files (about 800MB each) on this partition. Maybe it's possible to recover at least these files. If tar files all start and end with the same sequence of bytes there should be a chance of finding them on the 20GB HDD. Does anyone no how to identify tarfiles in raw partition data?
I would keep looking for a better solution than what I mention below, but if all else fails...
If nothing has been written to that disk since, you may be able to recover some of the files. I can recommend two methods.
If there are specific types of files you want, you can use "foremost" (see http://www.samag.com/documents/s=8859/sam0309a/sam0309a.htm). It allows you to specify a unique header and footer for a file type (e.g. ffd8 and ffd9 for jpeg). It will then comb through your partition saving evertyhing between the headers and footers it finds. It worked nearly perfectly for me to recover some digital photos. I was able to cover 149 of 150. The 150th was recovered, but had a black band near the bottom. I suspect that some data was written over it. It is also surprisingly fast.
The other tool, which is more popular but I had less success with, is the Coroner's Toolkit (TCT). It is available as a deb (i.e. apt-get install tct). You can use "unrm" to extract all allocated blocks to another partition. Then you can use lazarus to go through all that output and try to identify and save files. You need a lot of space for this. I couldn't use unrm because it wouldn't read my version of reiserfs, but you can also use dd to pull the data. The disadvantage is that dd pulls all blocks - both allocated and unallocated. That takes even more space.
Good luck! -- Brian J. Stults Assistant Professor Center for Studies in Criminology and Law University of Florida phone: (352) 392-1025 x207 fax: (352) 392-5065