file recovery for bad drives

[nbodley at speakeasy.net (Nicholas Bodley)]

On Wed, 06 Sep 2006 21:39:20 -0400, Tom Metro <blu at vl.com> wrote:

> Nicholas Bodley wrote:
>> Some time back, I mistakenly over-wrote a FAT32 archive partition...
>> with an ext3fs.
>
> Given that it is FAT32, you might find your time is better spent by  
> buying a commercial recovery tool.

I have considered that; one from Germany looked very promising, and you  
could pay various amounts to enable more or less of it.

> There are a lot of them. Many relatively cheap ($50 or less). Some  
> freeware. Restorer2000 is an example of a commercial tool I've used.
  (http://www.restorer2000.com/)
> PC INSPECTOR is an example of a freeware tool (which I haven't tried).  
> (http://www.pcinspector.de/file_recovery/UK/welcome.htm) There's also an  
> 'unformat' tool kicking around that might do the trick.

I'll look into thos; thanks much!

> But you'll need to run them from Windows,
Likely to be OK.
> and you'll probably need to leave the files in place on the partition -  
> not copied to an image file on some other drive.

Looks like very valuable advice!

> You can always do that in parallel to anything else you try. It's always  
> a good idea to backup a drive before attempting any recovery operations   
> anyway.

> A command like:
> dd if=/dev/<partition> of=/path/to/image/file
> should do it.

Good! I was thinking I'd need to get the block total correct; seems that  
"end of partition" is auto-sensed, which is very reasonable and expected.

I plan to study [man dd], too.

>> ...am curious about whether there's any chance of reconstructing the  
>> FAT(s).

> There may be a copy still intact.
If the second copy starts closely after the first, I'm probably out of  
luck. Seems that ext3 writes a fair amount at the beginning of its  
partition, and it probably over-wrote both FATs.

> But even if the FAT was fully restored, some of your data still might  
> have gotten clobbered by the ext3 formatting, which probably writes to  
> different areas of the disk than FAT32.

Something like inode clusters, although I'm probably using the wrong term.  
That's what I expect. Some files, or parts of them, are lost except to  
those with huge amounts of money.

> You'll probably be able to recover many of your files using  one of the  
> automated tools mentioned above.

That's what I expect.
>
> This article:
> How a Corrupted USB Drive Was Saved by GNU/Linux
> http://www.linuxjournal.com/article/8366
>
> describes one way to do a manual partition recovery.

I scanned that, and don't know nearly enough; such topics as FAT details,  
offsets, etc. are yet to be learned. (I can do OK with a hex editor,  
though. I speak hex with decent fluency.) Nevertheless, thanks, kindly!

One thing about looking at the munged partition is that it's an empty  
ext3fs written over a FAT32 partition with lots of data. To make any sense  
of a hex dump, I'd need to learn details of both filesystems. (^_^)

Again, Tom, many thanks! I rarely print anything, but your message has  
been folded and tucked safely into my machine. Hard to lose track, that  
way. :)

-- 
Nicholas Bodley  /*|*\ Waltham, Mass.
A commentator for Howthingswork at YahooGroups

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.