Never write anything to a disk you are trying to recover data from
Also, if possible, make an image of the disk with
ddrescue or whatever suits you.
Download a linux live cd (I strongly recommend System Rescue CD)
Use testdisk to recover the old partition table. This would be the basic steps:
fdisk -l to find out your disk device node
testdisk </dev/sdX> replacing accordingly
- Selectthe partition table type (usually
- Select the
From here on, it depends on whether it found your lost partition and it's recoverable. Follow the step by step guide for more detailed steps.
testdisk didn't manage to find your lost partition, chances are part of the information got overwritten. A good choice now would be to use photorec to try to recover as much files from it as you possibly can.
photorec will read the disk bulk and use heuristics to recover as much files as it can from the raw data. It will be up to you then to browse through the recovered files and find what's useful and what's not.
photorec are included in System Rescue CD.
You could also try to make an image of the unallocated space only, and run photorec on that image. It should be faster. I assume you already have an image of the disk at
bash # sfdisk -l -uS image-file
Disk image-file: 0 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0
Device Boot Start End #sectors Id System
image-file1 * 2048 206847 204800 83 Linux
image-file2 206848 4401151 4194304 82 Linux swap / Solaris
image-file3 4401152 312581807 308180656 83 Linux
image-file4 0 - 0 0 Empty
So from this info we know the block size is 512 and the last partition ends at 312581807. We need to extract from there on:
dd if=image-file of=unallocated-space bs=512 skip=312581807