up vote 2 down vote favorite
2

I have a 500GB drive. The first 100GB was an ext3 Ubuntu 9.04 installation, the last was formatted as a 400GB ext4 for storage. I had a lot of files on that 400GB partition - most weren't important, but there may have been some that were important and not backed up.

This is too bad because at 2AM last night I reformatted the first 300GB of the drive by dd cloning a 300GB drive to it. So the drive became 150GB ext3 Ubuntu 8.04, 150GB xfs, and 200GB unformatted (the last half of what was my 400GB ext4). The xfs partition that was copied was empty on the original disk, but since I used dd, I think that means all the sectors were overwritten (is that correct?). In which case I would literally only have data for the last half of the 400GB volume I'm trying to recover from.

  1. What are the chances I'll be able to recover any of the files off of the ext4 drive? If it's a wild goose chase I'll stop now.
  2. If it's worth a shot, what would be the best tool to do it with?

EDIT: The answer (placed here because it's sort of buried in the comments below) was using the PhotoRec utility from the SystemRescueCd live CD. It recovered quite a few files even though half the partition had been overwritten.

share|improve this question
    
You are correct, dd overwrites all blocks. – liori Aug 9 '09 at 21:18
up vote 3 down vote accepted

chances are you will not be able to recover your data. In this situation it is likely that the previous data on the ext4 partition was overwritten. If your first partition size was originally 100GB then any subsequent imaging would need to be the same size otherwise it would cut into the 400 GBext4 partition. Any partition larger than the original 100GB will cut into the 400GB partition and result in the erasure of data. The 300 GB partition you created effectively wiped out the 400 GB partition because the two invariably must share some of the same sectors on the disk.

share|improve this answer
    
I'm know I won't be able to recover ALL my data since 50% of it was erased! But (depending on how the file system works) there may be a lot of files that were untouched because all their data was in the top half. The question is whether a good data recovery tool might be able to find them or not. Knowing very little about extX filesystem, I don't know if pulling random files out of the goo is relatively easy (I've had to do similar things with FAT and NTFS and it worked pretty well) or relatively impossible... – Fred Hamilton Aug 9 '09 at 21:35
    
Here is my suggestion. Make an image backup of the partition which still has the remnants of the data you are looking to recover. Once you do this you will likely need to piece the files together bit by bit. Chances are you blasted the directory listing, but if by chance you still have it, you can recover any file you have in its entirety. – Axxmasterr Aug 9 '09 at 21:39
    
What's the best utility with which to recover any recoverable remnants? – Fred Hamilton Aug 12 '09 at 23:34
    
Try looking here - > sysresccd.org/System-tools This is a rescue CD that has some tools that will help recover ext4. Most of the other tools I would recommend do not work on Ext4 . – Axxmasterr Aug 13 '09 at 1:01
    
Good suggestion. I ended up using the PhotoRec utility from the SystemRescueCd live CD (sysresccd.org/Main_Page) you pointed to. The author (Christophe Grenier) was very helpful and responsive when I need some clarification. – Fred Hamilton Aug 23 '09 at 18:48
up vote 3 down vote

extundelete: extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. http://extundelete.sourceforge.net/

share|improve this answer
up vote 0 down vote

Im sorry but I have to disagree with axxmasterr

You are able to recover data following a dd clone. I had a client who accidently performed a dd on x3 1 tb drives twice, (dont ask how he did this) and data recovery was 100% possible. We recovered all his files. The only issue we had was the size of the drives, being 1 terabyte called for a load of memory to run the data recovery analysis.

Use a tool called R-Studio. It runs from windows, mac or linux. It recovers any type of file system, more or less. You will be surprised what it recovers. It performs deep analysis of drives. I have never had any issue even after multiple formats on drives or mac, linux, bsd. Yes at some point the data will be re-written completely over. But until that point, its possible to get to close 100% back.

I dont work for r-studio to clarify.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.