[ale] any easy way to recover deleted partitions and their contents from HD ?

[James P. Kinney III]

On Sat, 2004-04-17 at 16:05, Courtney Thomas wrote:
> James,
> 
> Thank you again.
> 
> The partitions deleted were DOS FAT16. Can I use a linux emergency disk to try 
> to recover ? There were 4 partitions, all exactly 2008MB.

I would recommend a Linux emergency disk instead of a DOS floppy. 

The critical issue is whether or not data has been overwritten by the
partitioning process. 
Consider the bad ASCII art below:
               _____________________________
Original disk  |  1   |   2  |   3  |  4   |
               _____________________________
new partition1 |  1   |   2  |              
               _____________________________
new partition2 |  1   |   2                |
               _____________________________
new partition3 |      1     |      2       |

The difference between original and 1 is simply the deletion of the two
partition markers for partitions 3 and 4. This is recoverable (usually)
by remaking the partitions in the exact same spot as before. 

Version 2 requires the deletion of 2,3,4 and creation of a partition 2
that fills the disk. This is also most likely recoverable. Delete 2 and
recreate 2,3,4 in the original locations.

Version 3 is not good. Since new partition markers have been created,
this will have overwritten a small portion of the disk. It may be
possible to recover most of the data if all the partitions are removed
and then recreated at to the original specs. The big issue arises if the
partition (original or new borked one) is a "sloppy" partition that
crosses some sector size boundaries. In theory, a partition must be an
integer multiple of sectors. The Linux tools enforce this. DOS tools do
not. This will allow a partition boundary that is in the middle of a
sector. (This is bad. Very bad. It's one of the reasons that DOS {and
Windows} had such filesystem issues that drove people nuts). The Linux
tools will not let you make a partition back where the stupid DOS
partition was as it is not a proper "fit". Add to this mix the LBA stuff
and things get messy real fast.

My strongest recommendation is to first do a dd backup of the hard
drive. The noerror option might be a good idea. This way you can at
least recover to where you are now if things get worse.

There are other tools that are lower level, block-by-block read tools
but I have no experience with them. An old hard drive that can be
trashed would be a good idea to practice on.
> 
> Appreciatively,
> Courtney
> 
> 
> On Friday 16 April 2004 20:01, James P. Kinney III wrote:
> > 1. Really current backups.
> > 2. The exact partition configuration before the Oops.
> > 3. Luck that nothing was done other than take a 2 (or higher) partition
> > drive and change it to a 1 partition drive.
> >
> > Using the data from #2, fdisk the drive and remake the partitions back
> > the way they were. DO NOT USE THE DOS FDISK!! The Linux fdisk is rather
> > gentle and will only write the partition markers.
> >
> > It might work to dd the drive to a file and try mounting the file using
> > -o loop.
> >
> > If it was a 1 partition drive that was borked into a multi-partition
> > drive, the data that was at what is now partition boundaries is lost.
> >
> > On Fri, 2004-04-16 at 20:13, Courtney Thomas wrote:
> > > Thank you.
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO & Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
http://www.localnetsolutions.com

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
<jkinney at localnetsolutions.com>
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part