Re: Please help: Accidentally wiped off the whole hard disk!!!
On 5/13/05, Jeremy T. Bouse <jbouse@debian.org> wrote:
> Quite a pickle you've found yourself in, this is a good example
> for why not using root much is good. If at this time all you've done is
> repartition and save the partition table then the data *should* still be
> in tact on the drive. Experience with data forensics has taught me this.
Yes, but even if I had done a sudo, still I might have done the same
thing. My fault was that I became careless in using the write command
in fdisk. I shoould have double-checked.
> As someone else mentioned if you have the *exact* partition
> table configuration prior to this re-partitioning nitemare then you
> should be able to simply re-parition and set it back up. In order to do
> this you need to have the exact "Start" and "End" values for each
> partition. If these are off you could risk losing the data in the
> partition or that it may just not be available.
>
> Let me put the disclaimer out there that partitioning is a
> destructive process by it's very nature. Just re-partitioning it as you
> already have done *may* lose data (again it may not), and attempting to
> correct it *may* lose data (again it may not). Just saying there is no
> guarantee in anything dealing with re-partitioning.
Someone mentioned that it's theoretically possible to reconstruct and
get all data back. How much is it practically possible and what are
the reasons for failure, provided I do it very methodically and have
the exact partition info? When does this "may lose data" come in to
picture? Please explain.
> Provided the Knoppix LiveCD has fdisk available, and provided
> you have the exact partition table information from before the failure
> you should be able to boot off the CD and correct the partition table.
> Again while running under the LiveCD you should be able to attempt
> mounting the partitions *ONE-BY-ONE* in *READ-ONLY* mode without running
> fsck to see if the data is still there. The read-only mode and not
> running fsck is to make sure that nothing is attempted to be written to
> the drive. If this all succeeds then reboot again under the LiveCD and
> test the partition data again to make sure it passes a "reboot test" and
> is still available before attempting to boot it up under it's own power.
> You may need to have a LILO or GRUB boot-floppy available if the MBR was
> modified so as to make it non-bootable.
Well, I have the exact partition info at hand (Now I have written it
down in my diary too so later it's handy just in case.) Okay I will
mount the partitions RO and one by one. Could you please clarify what
do you mean by a "reboot test". Just checking on the data is okay? Do
I still need to have a grub floppy even tho I never repartitioned this
after the first time?
> There is a risk of data loss, which comes with dealing with
> re-partitioning but if you have accurate records of the prior partition
> table and proceeed methodically and logically you can limit those risks.
> I do not advice doing anything mentioned if you do not feel confident in
> any of the steps necessary or the information you have on the partition
> table. If you have an extra machine you could test with that you aren't
> worried with the data, you could attempt it on there before trying it on
> the machine in question. I would try it myself here if I had such a
> machine, but unfortunately the only way I could do so would be through
> VMware which might not be entirely accurate.
Thanks Jeremy. I will attempt this first on a spare hard disk as
mentioned earlier. I'm installing this Knoppix on to it (save the
fdisk info) and then will fdisk it and make one solaris partition as I
did on the drive in question, and then try the recovery. Do I need to
have another machine for this?
Regards,
Deboo
--
Please don't Cc: me, I'm subscribed to the list.
Reply to: