[CentOS] Retrive data from repartitioned / reformatted, hard drive?

"Mark Hull-Richter" <mhullrich at gmail.com> wrote:

> On 6/28/07, Niki Kovacs <contact at kikinovak.net> wrote:
>   
>> > Hi,
>> >
>> > The title says it all. One of my clients showed me a 120 GB hard drive
>> > that his daughter accidentally formatted, according to him. I booted the
>> > first CD I had at hand - a Slackware 11.0 install CD - and launched
>> > cdfdisk /dev/hda. cfdisk informed me that there was even no partition
>> > table. So much for reformatting. cfdisk only shows me 120 GB of free space.
>> >
>> > Any way to retrive data on this hard drive? Some magic live distribution
>> > to read data on repartitioned / reformatted hard drives? any suggestions?
>> >
>>     
>
> If it was actually reformatted, you'll have to go to one of the data
> recovery services - getting at data buried under a true reformat
> requires some seriously expensive and high-tech equipment.
>
> If it was just repartitioned, you might be able to recover the data
> using one of several less (but still) expensive data recovery tools
> that are available on the market.  If you work for any IT company, see
> if your systems administration / MIS / IT group has something like
> that (or just ask around) - many do.
>
> When I worked at Quest Software, the MIS department had these for the
> occasional disk crash data recovery, and I was lucky enough to get one
> of my partitions back that way, although four files (out of hundreds)
> were still damaged and so far unusable.
>
> Good luck.
If you just want to confirm that some data is still there, you might try 
something like:

1) Boot from any Linux live CD (knoppix, Fedora 7, etc.).
2) Open a command window.
3) Assuming this is the only hard drive and it's /dev/hda:

dd if=/dev/hda | grep 'some *short* string that should be present'

4) If your string survived, you should see something like "binary file 
matches'.

On my laptop (dual boot to XP home or CentOS5) I see:

[root at spindle ~]# dd if=/dev/hda | grep -i dos
Binary file (standard input) matches

Alternatively, there are some disk editors for Linux.  Google turned up 
LDE which claims to mimic the old "Norton Disk Editor."  If you go this 
route, you would probably do better sticking the drive into a Linux 
system although you might be able to find someone who has set up a Linux 
recovery live CD that includes LDE.  I haven't used LDE but the old 
Norton tool was pretty amazing.

Any idea what file system was on the disk originally (vfat, ntfs, ext3, 
etc.)?

Cheers,
Dave

-- 
Politics, n. Strife of interests masquerading as a contest of principles.
-- Ambrose Bierce