Questions about recovering data. Includes data loss due to hardware failure, software failure, and user or administrator failure (accidental delete). Please also add tags for the specific things involved, such as /raid, /ext4, /hard-disk, /rm, etc.

learn more… | top users | synonyms

2
votes
0answers
111 views

Drive disappears from dev during ddrescue copy or testdisk recovery

I have been trying to recover data from a Seagate 7200.11 1.5TB drive (2 ext4 partitions_ for 3 days now, predominantly with ddrescue and testdisk, but because of some critical error on the disk ...
0
votes
1answer
52 views

Mount a file collection in a linux environment

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
-1
votes
1answer
23 views

Trying To Get Data From Server HDD

I had two CentOS 6.5 servers that I was running using the Plesk control panel. I have moved and decided not to use them no more but just buy my hosting. My new ISP blocks port 80 and the cost is ...
1
vote
1answer
125 views

Clunking hard drive, some info appears in dmesg but none in fdisk -l, what are my options?

I've been backing up old IDE hard drives onto a new USB drive this afternoon. One, a 2002 120gb Western Digital, has been a bit of a problem. I have connected it (as with the other hard drives) to ...
0
votes
0answers
393 views

mdadm raid 5 missing partitions after reboot

I had a working raid 5 array that had a whole debian install on it (I set it up during a debian install). I'd been using it a couple of days, all was fine, but since I created it during debian ...
1
vote
1answer
53 views

backup inode table on ext2/3/4

is it possible, to backup on regular basis inode table (including all inode information) on ext2/3/4? If yes, how to do it, or which program to use?
1
vote
1answer
102 views

lost directory cannot find it with testdisk

I was moving a directory on my parents computer using a teamviewer session. The session responds slow and somehow, when I was moving the directory (location: /sdb/synchronisatie/nel/) something went ...
5
votes
2answers
338 views

encrypted ext3 damaged; how to proceed?

My home partition on a Debian wheezy install is an encrypted LVM volume. It is ext3. Earlier today, I had a weird message in a terminal window about an attempt to write to a file in my /home tree ...
1
vote
1answer
62 views

Read files after running ddrescue

I have run ddrescue on a hard disk, and got all data (2 partition) to another disk named part1.img and part2.img. How to proceed to read (list) the files in part2.img? I use fedora 14, 32 bit
2
votes
1answer
476 views

How to copy partioning information with dd?

I am trying to recover partitioning information using TestDisk. To try things out I copied all data from the original harddisc to another physical drive using dd as follows: $ dd if=/dev/sda ...
0
votes
1answer
7k views

How to recover the partition table (Windows, Ubuntu) of an unallocated disc?

The following screenshot shows the current state of my hard disc. The unallocated part of the disc used to contain two operating systems: Windows and Ubuntu, in this order. Windows has been ...
0
votes
2answers
186 views

I accidentally formatted the wrong volume - is it possible to restore the previous Ext4 filesystem?

I know that a similar question has already been asked. This morning I accidentally formatted the wrong volume, containing mostly video files (about 30GB each). I am currently trying to restore the ...
1
vote
0answers
776 views

linux fedora 20 how to read data from usb drive

I installed Linux Fedora 20 on a new computer, and kept the hard drive from the old computer as a second backup of my data. The drive has two partitions, Windows XP on one and Fedora 12 on the other. ...
3
votes
3answers
155 views

Recovering data from a failing RAID 5 setup

I have a four disk RAID 5 array that is in the process of failing hard. One disk is completely dead and smartctl is telling me that a second disk is failing. All the data on the RAID is backed up, ...
7
votes
3answers
25k views

undelete a just deleted file on ext4 with extundelete

Is there a simple option on extundelete how I can try to undelete a file called /var/tmp/test.iso that I just deleded? (it is not so important that I would start to remount the drive read-only or ...
2
votes
1answer
296 views

How can move a LUKS container from the middle of a partition to the beginning?

For the tl;dr, skip to the bottom. I have a dual-boot setup with Mac OS X at the beginning of my drive and three GNU/Linux partitions at the end of the drive. I don't have the relevant machine on ...
1
vote
2answers
664 views

Restore formated Partition Table on LVM Physical

I have a machine (guest VM running CentOS 6.5) with 2 disks. Main OS on sda and then a 2TB LVM on the second sdc. I added 2 more 2TB disks to the machine and was going through the process of ...
2
votes
1answer
126 views

How to link the unlinked files?

When you rm a file it will call unlink(), and unlink() will remove the file from the Directory entry and its inode is freed. But, the actual content of the file is still in the disk. Is there any way ...
1
vote
2answers
167 views

Accidentally deleting crucial libraries

If you accidentally delete a crucial library folder, such as /usr/lib, how can you recover from that?
3
votes
1answer
655 views

Is pvcreate destructive? Attempting to recover an lvm2 volume group

I don't want to lose any data, so I'm asking if the solution Novell offers is safe to try. If not, are there safe alternatives? Step-by-tedious-step: I have two volume groups: main and Rand; Rand ...
1
vote
1answer
1k views

Symlinks and permissions in backup archives

I installed linux on another computer and I want to move my /home directory to that computer. I want to backup that directory with any file permission, symlinks etc. how should I do it? Are there any ...
0
votes
2answers
4k views

Restoring a big partition to a smaller partition with Clonezilla

Some time ago I created a backup of an EXT4 partition with Clonezilla. Now the HDD crashed and I lost some important data. The size of the image of the partition is 50GB. I tried to restore this ...
2
votes
0answers
361 views

How to find orphan directory entries in a ext4 disk

This comes from a long story of trying to recovering a TrueCrypt volume from a hardware failure (thanks, WD). I ended up with an unencrypted 3TB image that had the files that I want to recover. ...
0
votes
2answers
80 views

unmount pendrive discarding changes

Is it possible to unmount a (FAT32-formatted) pendrive without committing changes? Use case: easy recovery of accidentally deleted files
1
vote
1answer
110 views

recovering /home folder from faulty drive

I was going to try ddrescue to recover data from a faulty (beeping) laptop drive and a primary ext4 partition. Reducing the number of reads from the disk should reduce the recovery time and increase ...
3
votes
1answer
6k views

Where does MySQL store its databases on Debian?

Our system crashed and we're trying to recover our data. The disc is fine, but the OS is gone, so I'm trying to get at the actual MySQL database files. Does anybody know where to look for them in a ...
4
votes
3answers
14k views

Recovering data from a damaged hard-drive: the “freezer trick”

I'm currently in the business of recovering data from a damaged---and dying---hard-drive (check this question for background info). The drive was dropped while the system was running; and while ...
0
votes
2answers
64 views

What is the minimum size for the medium used to clone a damaged hard drive?

I'm currently in the business of recovering data from a damaged---and dying---hard-drive (check this question for background info). The damaged hard-drive is 250GB, and I intend to use dd or ddrescue ...
0
votes
1answer
85 views

Unbootable system, uneditable boot options

My distro (Trisquel, a modified version of Ubuntu 12.04) comes with a 3.2.0-38 kernel. I recently reinstalled it, and after installing a bunch of updates I found that boot would hang on the splash ...
5
votes
3answers
26k views

How to repair a corrupted HFS+ partition from a damaged hard-disk?

I have a friend's Mac OS X disk that comes with an HFS+ partition. I am supposed to recover the personal data from this disk, and I'm not yet sure if the filesystem is corrupted or the disk is dying). ...
4
votes
1answer
150 views

How to know what files got deleted?

I'm working on Ubuntu 13.04. yesterday from a Windows 7 partition, I accidentally deleted many files. I deleted by pressing shift-del. Is there any way to know the name of the files that got ...
2
votes
1answer
114 views

How to recover data lost during aborted local drag and drop?

I have dragged and dropped a large amount of data between two tabs of Thunar (XFCE 4.10) but accidentally clicked cancel during the process. The data have been removed from the source folder and are ...
0
votes
1answer
161 views

e2fsck giving some error

I am playing with LVM and while doing lvreduce. I now get this error: [root@localhost raja]# e2fsck -f /dev/vg1/lvol2 e2fsck 1.41.12 (17-May-2010) e2fsck: Superblock invalid, trying backup blocks... ...
1
vote
2answers
1k views

How to restore my system after reinstalling Ubuntu?

I'm presently having Ubuntu 13.04. I am wishing to change it to the next version by installing the next version i.e. Ubuntu 13.10 using bootable DVD. For that I will 1st download .iso image from ...
1
vote
0answers
41 views

Retrieve spanned archive from raw disk image

When I open the image in a hex editor, there is the header of a PK spanned archive (50 4B 07 08), then 4 more zip files following (50 4B). When copying the values and saving as a zip file, the ...
2
votes
1answer
229 views

Finding modified date and time of file from recovered disk image

Some jpeg files have been recovered from an image file of a floppy disk. Is there a way to get the modified, created and last accessed date and times of those files recovered, i.e. the time and date ...
0
votes
0answers
24 views

Recover directory structure + files [duplicate]

Background: I had a dual boot of Windows + Linux Mint. Mint didn't feel right to me, so I decided to install Ubuntu to replace Mint. I booted from a Ubuntu Live USB and started the installer. The ...
1
vote
2answers
326 views

How do I recover an ext4 volume overwritten by an LVM logical volume?

I was running an Ubuntu desktop. The OS was installed on a SSD. I had two additional drives formatted ext4 and mounted on /storage (1TB) and /storage-bak (1.5TB). I installed Centos over Ubuntu on ...
3
votes
4answers
2k views

How do I find the offset of an ext4 filesystem?

I have a failing hard drive that is unable to write or read the first sectors of the disk. It just gives I/O errors and that is all there is. There are other areas on the disk that seem (mostly) fine. ...
4
votes
2answers
222 views

How to recover TrueCrypt datas?

I have 1GB worth of data locked up in an encrypted TrueCrypt volume and I forgot the password to it. Is there any way to recover it?
0
votes
0answers
100 views

photorec couldn't recover last saved file

Yesterday I deleted by mistake the content of current directory which had many c programs. Later I successfully recovered all the files (using command photorec) with one issue. The issue is: for 1 ...
11
votes
2answers
53k views

How to recover files I deleted now by running rm *? [duplicate]

By mistake I ran rm * on the current directory where I created many c program files. I had been working on these since morning. Now I can't take out again the time that I spent since morning on ...
0
votes
1answer
206 views

rm -rf /home/ Recovery [duplicate]

OS :-Suse Linux Enterprise 12.0 File System :- ext3 I hit rm -rf /home/, immediately I did Contol+C so the command got canceled but until that time I lost ~9GB of data from this /home dir. I don't ...
1
vote
1answer
189 views

Recover Files Incorrectly Written to a USB?

I tried to transfer ('cut and paste') about 2gb of files from my system (running Linux Mint 15, KDE 4.2) onto my USB stick (8gb capacity). The notifications manager indicated that the copy was ...
3
votes
1answer
4k views

recovery data from RAID and disk failure (Linux)

Some background A friend of mine was using in his office a NAS Buffalo-LS-WVL with two disks of 1TB each. It seems that the two disks were mounted as raid 1, but, as you will read, probably they have ...
2
votes
1answer
856 views

Tar ignore or fix checksum

I have a archive backup.tar that was created with a nonstandard program a long time ago. I no longer have access to the original program. The archive is Not compressed (gzip). When trying to extract ...
1
vote
1answer
59 views

Restored VG has shifted volumes

I'm recovering a PV on a mdadm RAID 1 with a single VG containing several LVs. The underlying devices have several bad sectors (one just a few, the other really much) and a silly typo made it ...
5
votes
1answer
1k views

Overwritten MBR: Is partial/complete recovery possible?

I have a Sony VIAO laptop setup as dual boot (Ubuntu 12.10/Windows 7). Since I wanted to try Archlinux, I installed VirtualBox in Ubuntu. To create a bootable USB stick (from the ISO image on my hard ...
5
votes
4answers
5k views

I've wiped my partition table using gparted, is there a way to recover my partition?

I've wiped my NTFS (windows) partition table using gparted by clicking on "Device->Create Partition Table... and then apply", is there a way to recover my NTFS partition? I tried using this command ...
2
votes
1answer
191 views

recover partially overwritten tape from tar -c

I have a situation. I was supposed to run tar -x to recover a tar file from a tape but I pressed "c" and forgot to put the tape on readonly. The file was on fsf position 23, but the tape had 27 files. ...