bsd lost partition recovery

[Polytropon]

On Sun, 17 Feb 2013 18:30:28 +0700, Erich Dollansky wrote:
> > On Sun, Feb 17, 2013 at 2:31 PM, Erich Dollansky <
> > erichsfreebsdlist at alogt.com> wrote:
> > 
> > > >On Sun, 17 Feb 2013 12:56:54 +0330
> > > >takCoder <tak.official at gmail.com> wrote:
> > >
> > > >> *here's the question:*
> > > >> how to restore lost data of a formatted bsd partition?!
> > > >>
> > > >restore it from a backup?
> > >
> > 
> > no, from the formatted hard drive.. if only i had a backup..
> > 
> You did it the hard way.
> > 
> > >
> > > >> *and here's what has happened to me:*
> > > >> i was trying to install windows xp sp2 on a HD on my system to
> > > >> move it to another hardware after that for some reasons, but i
> > > >> had my main HD attached to may system as well..
> > > >>
> > > >> all of a sudden i made the worst misktake ever and formatted my
> > > >> main HD's bsd partition instead!!!
> > >
> > > If you want to read the data from that partition it will depend very
> > > much on how far the Windows installation really went.
> > >
> > > i just deleted the partition and then found out what i just did,
> > > then i
> > stopped the installation process and start looking ways for recovery..
> > 
> > till now, somewhere in the web i saw that R-Studio supports ufs
> > recovery but it's a windows application.. i'm preparing a system for
> > checking it right now..
> > 
> Just try it.

You can try R-Studio Emergency, a live CD, to _check_ if there
is anything to restore. This step is for free, as you don't need
to buy it. Also there's no need for installing anything on some
"Windows".

However, there are tools that can be used on FreeBSD (if you can
put the disk into another system). Note: Do not write to that
disk! If possible, make a dd image of the disk and work with the
image, do not _alter_ the original disk in any way. Every little
wrong step can decrease your chances for recovery.

I came to this list many years ago with a recovery problem, and
have learned a lot since that time (as I also had no backup and
still got my files back). So I'll try to give some suggestions.
But remember that it depends on your _specific_ setting on what
will possibly work and what won't.

As it has been questioned already, "formatting" can have several
meanings, especially in "Windows" land. The more actual content
of the disk got overwritten, the worse it gets. So if you've stopped
the installation at some point, it's still possible that your data
can be located.

Allow me to introduce a few tools to you (my meanwhile "famous list
of data recovery tools" which I've posted some times on this list):

A worst-case tool to recover data (not file names, but file
content) is testdisk; in ports: sysutils/testdisk. It's also
on some diagnostics and recovery CDs like UBCD.

You can also try this:

	fetch -rR <device>

Also recoverdisk could be useful.

The ports collection contains further programs that might be
worth investigating; just in case they haven't been mentioned
yet:

	ddrescue
	dd_rescue	<- use this to make an image of the disk!
	magicrescue
	testdisk	<- restores content
	recoverjpeg
	foremost
	photorec

Then also

	ffs2recov
	scan_ffs

should be mentioned. It's possible that the disk contains some
information to restore the initial UFS file systems.

And finally, the "cure to everything" is found in The Sleuth Kit:

	fls
	dls
	ils
	autopsy

In worst case. Just in worst case.

Keep in mind: Read the manpages before using the programs. It's
very important to do so. You need to know what you're dealing
with, or you'll probably fail. There is no magical tetroplyrodon
to click ^Z and get everything back. :-)

Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer"
can still be considered worth a try. Their trial versions are for
free. "UFS Explorer" even works using wine (I've tried it).

If you have one or two spare disks, initialize them in FreeBSD.
Make a dd image of your disk to the 1st disk. Use recovery tools
to write their results on the 2nd disk. Disks are cheap, at least
your data is worth more than two disks. And you're going to need
the disks anyway. :-)

I wish you best luck to get your data back. I can fully understand
how frustrating such a situation can be.


-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...