On 04/07/2011 14:37, Axel Freyn wrote:
Hi,So, the question is, how much is this data worth to you? If you made a backup before you started playing with it, it might not be more than $500 for a data recovery company to get your stuff back. If you didn't make that post 'oh shit' backup, your chance of recovering yourself went exponentially down and the price of getting someone else to get your stuff went exponentially up. If this is business, its possible your insurance might cover some of the cost (donno).Price is fine with me, the problem is that there is no such company I know of in Turkey. Any suggestions?If the data isn't worth money but you'd still like it back ...The data is important for me and worths money.Just an additional remark: with each time you mount the new partition write-enabled, you decrease the probability to recover your data (as you're going to change the contents of the disk more and more). So: ONLY mount it read-only and the safest thing would be to play only on a copy of the partition: - add another disk with more than 350GB free space (e.g. mounted to /mnt/) - copy your damaged partition there: (but verify twice that /mnt/partition.dd won't be generated on your destroyed partition :-)) dd if=/dev/sda1 of=/mnt/partition.dd - remove /dev/sda from your system ... then, "partition.dd" will be a 350GB file containing all data from your original partition sda1. You can now try to recover data from this file -- without risk to accidentally destroy your original partition. In order to recover the data, you could have a look at the Debian Forensics packages http://qa.debian.org/developer.php?login=forensics-devel@lists.alioth.debian.org however, I don't know which tools are available for XFS, I only tried it for ext2/3 sometimes. Axel
This is really a wise approach. Mine was far more insecure but still maybe interesting: since you just (quickly?) formatted to fat16, I think you only modified the partition table. Then, playing with parted, you could delete (i.e. will only delete the partition entry, not its content of course) the partition formatted to fat16 and then ask parted to search for unreferenced partitions. It should find the xfs partition and recreate the correct entry for it in the partition table.
Now, it seems you played a lot with your partition and things might be more complicated or might not (maybe you didn't change anything even if the partition was mounted rw, is that possible with xfs?).
NicolasPS: note that I once did this to recover 3 partitions: /, /home and swap and parted wrongly detected swap, it has a 8 byte offset I had to correct by hand, but everything was properly recovered, just double check the results (partition boundaries displayed as bytes or sectors), etc.