Re: [OxLUG] data recovery help needed

Top Page
Attachments:
Message as email
+ (text/plain)
+ frmitchell.vcf (text/x-vcard)
Delete this message
Reply to this message
Author: Dr. Faye Mitchell
Date:  
To: Oxfordshire Linux User Group Discussion List
Subject: Re: [OxLUG] data recovery help needed

If all you want is the data off and it's in a well known format (i.e. MS
Word, jpegs, etc.) you might be as quick using the data recovery tool
foremost - that can look at a disk image and retrieve things that look
like files of the type you want and you can easily check to see what
it's got. It's quick and it doesn't do anything to the partition (you
can run foremost on the /dev file that is the courrupted partition) so
you can do the more radical stuff later.

The backtrack live CD (http://www.remote-exploit.org/backtrack.html) is
a good place to use it from.

TTFN

Faye


phil Kolodij wrote:
> hi all
>
> the saga continues.. My Wd Mybook nas died so i pulled the disk, the fs
> used for the data partition was id's as Linux Raid by both Win and
> knoppix which i am running of a live cd.
>
> after a lil browsing i discovered that the fs should be ext3, so i used
> that type in my mount command to access the data.
>
> I started to copy data off and discovered the pc only has usb1
> functioning (a usb2 pci card is in the box)..
>
> but the copy process fell over last night.. (i used drag n drop copy and
> no usefull error message was remembered as i clicked without thinkin..)
>
> t tried fsck and came up with some errors, and left me not knowing the
> best way to proceed.
> (OldData is the mount point for the disk to recover /dev/sda4, NewData,
> the destination /dev/sdb1...)
>
> knoppix@Microknoppix:~$ fdisk -l
>
> Disk /dev/hda: 20.0 GB, 20020396032 bytes
> 240 heads, 63 sectors/track, 2586 cylinders
> Units = cylinders of 15120 * 512 = 7741440 bytes
> Disk identifier: 0xf9460f44
>
>    Device Boot      Start         End      Blocks   Id  System
> /dev/hda1   *           1        2585    19542568+   7  HPFS/NTFS

>
> Disk /dev/sda: 1000.2 GB, 1000204886016 bytes
> 255 heads, 63 sectors/track, 121601 cylinders
> Units = cylinders of 16065 * 512 = 8225280 bytes
> Disk identifier: 0x00007c00
>
>    Device Boot      Start         End      Blocks   Id  System
> /dev/sda1               4         369     2939895   fd  Linux raid
> autodetect
> /dev/sda2             370         382      104422+  fd  Linux raid
> autodetect
> /dev/sda3             383         505      987997+  fd  Linux raid
> autodetect
> /dev/sda4             506      121601   972703620   fd  Linux raid
> autodetect

>
> Disk /dev/sdb: 1500.3 GB, 1500301910016 bytes
> 255 heads, 63 sectors/track, 182401 cylinders
> Units = cylinders of 16065 * 512 = 8225280 bytes
> Disk identifier: 0x742fd276
>
>    Device Boot      Start         End      Blocks   Id  System
> /dev/sdb1               1      182401  1465136001    c  W95 FAT32 (LBA)
> knoppix@Microknoppix:~$ fsck /dev/sda4
> fsck 1.41.3 (12-Oct-2008)
> fsck: fsck.mdraid: not found
> fsck: Error 2 while executing fsck.mdraid for /dev/sda4

>
> knoppix@Microknoppix:~$ fsck /OldData
> fsck 1.41.3 (12-Oct-2008)
> e2fsck 1.41.3 (12-Oct-2008)
> fsck.ext2: No such file or directory while trying to open /OldData
>
> The superblock could not be read or does not describe a correct ext2
> filesystem.  If the device is valid and it really contains an ext2
> filesystem (and not swap or ufs or something else), then the superblock
> is corrupt, and you might try running e2fsck with an alternate superblock:
>     e2fsck -b 8193 <device>

>
>
> ** Normally I would be happy to play about with this and learn as i go,
> but as I am trying to recover data from a disk which has got problems,
> the longer i faf n fail; the more chance i have of loosing the data
> forever.. its taken me days to get knoppix up as i initialy tried using
> a 10inch 16 colour vga screen which only gave me shell access before i
> borrowed a bigger one...
>
> should i consider formating my destination disk (external usb) as ext3
> and using a low level copy like dd or dd_rescue to move the data before
> validation? if so could i then convert the fs to a (sorry about tis )
> win friendly fs with a tool akin to partition magic??
>
> there is a pint or 6 in anyone who lead me in the correct direction
> here, my unix skills are way out of date and the notebook with all my
> cribs in is lost..
> I have a dip in linux waters every now n again but am not a proficent
> user at all and am at the bottom of the beginers pile i fear having used
> little else than a browser n wordprocessor the last 6 yrs
>
> tia PK.
>
>
>
> --
> This message has been scanned for viruses and
> dangerous content by *MailScanner* <http://www.mailscanner.info/>, and is
> believed to be clean.


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

begin:vcard
fn:Faye Mitchell
n:Mitchell;Faye
org:Oxford Brookes University
email;internet:
title:Senior Lecturer (Computing) & Equality and Diversity Co-ordinator (School of Technology)
tel;work:01865 484544
x-mozilla-html:FALSE
version:2.1
end:vcard