A big mistake!

hirohitosan

hirohitosan

Hi guys!
I made a huge mistake! During installing FreeBSD on one of my computer I accidentally format (UFS) an USB HDD (fat32) attached to that computer. There are any chances to recover my data?
thanks!
 
Recuva, Zero Assumption Recovery, and GetDataBack might help. (Got data back from an SD card for a friend when his kid hit format on his camera a few months ago.)

Depending on how the UFS format works, you *may* be able to simply go into fdisk and change the type back to FAT32 (I think 0c). If the UFS format overwrote the FAT though, this won't work. I'd probably try this first; you can always change it back to UFS and the only thing that would be written out is the file system descriptor bit in the partition table.
 
there are as well several unix forensic tools like autopsy. give it a shot, i am pretty sure u will be successful, afaik UFS is not NULLing the space, so u should be able to recover most of your files. good luck!
 
1... do you have backups of the fat32?
a... maybe "dd= ... (stuff)" to backup the disk (raw)
to a spare drive that is at least the same size.
and operate on one of the two results.
if so, maybe make a file: (unless you know of another way)
(call it, fix_file.txt)

p 1 11 * 8G



Code: 
 fdisk -f fix_file.txt -v -u /dev/[disk]
(that [disk] will probably be the shorter of the
drives's names in /dev, the install probably created lots.
...
check that file syntax first in "man fdisk...", no time here. !! Also that 8G was specific to this machine
and probably is totally USELESS in your specific
case, making the command damaging without a proper
number.
*if fdisk will see the disk
* that might "just" fix the fat table, or it may
...make it unrecoverable. I don't really know.
...there are also other fat32 types (15 I think...)
...that (maybe) should be used instead of 11...
 
thank you guys!
I installed PhotoRec and for a few day it's spinning the HDD. It recover a lot of files but the filenames are changed. So I'll wait until finish and see what't happen.
 
Also, when you recover files, check their validity. These utilities work at their optimum when filesystem fragmentation is low. If the FS is very fragmented and the FAT and its backup have been overwritten during the newfs, the utility may have a hard time guessing the file parts' locations and you may get a lot of corruption, with truncated files or files bearing the tails and heads of others.
 
look what I done:
first I created as root a text file fix_file.txt where I added p 1 11 * 8G. My external HDD is da0 so
Code: 
u# fdisk -f fix_file.txt -v -u /dev/da0
******* Working on device /dev/da0 *******
parameters extracted from in-core disklabel are:
cylinders=38913 heads=255 sectors/track=63 (16065 blks/cyl)

Figures below won't work with BIOS for partitions not in cyl 1
parameters to be used for BIOS calculations are:
cylinders=38913 heads=255 sectors/track=63 (16065 blks/cyl)

Information from DOS bootblock is:
1: sysid 15 (0x0f),(Extended DOS (LBA))
    start 63, size 16771797 (8189 Meg), flag 0
        beg: cyl 0/ head 1/ sector 1;
        end: cyl 19/ head 254/ sector 63
2: <UNUSED>
3: <UNUSED>
4: <UNUSED>
fdisk: Class not found
I don't understand the message ...
does it works or not?
I can mount the disk:
Code: 
u# mount /dev/da0s1e /mnt/hdd-extern/
u# ls /mnt/hdd-extern/
.snap           games           libdata         sbin
PCBSD           home            libexec         share
Programs        include         local           src
X11R6           jails           portjail
bin             lib             ports
 
thanks aragon. As I mentioned before I accidentally format a FAT32 partition with UFS and now I want to restore if it possible the FAT32 partition.
Code: 
# gpart show
=>       63  625142385  da0  MBR  (298G)
         63   16771797    1  !11  (8.0G)
   16771860  608370588       - free -  (290G)

=>       0  16771797  da0s1  BSD  (8.0G)
         0   4194304      1  freebsd-ufs  (2.0G)
   4194304   8384512      2  freebsd-swap  (4.0G)
  12578816   2097152      4  freebsd-ufs  (1.0G)
  14675968  610455552      5  freebsd-ufs  (291G)
this is the disk that I formatted. It is possible to recover the information that was lost by formatting? I never used gpart or fdisk utility and I'm not used with them. As I understood from jb_fvwm2 it is possible to restore the FAT32 table and to recover my data.

It is correct?
thanks
 
hirohitosan said:
it is possible to restore the FAT32 table and to recover my data.
Click to expand...
Very unlikely. The most important structures in a FAT32 FS are the "root directory" which starts at the beginning of the data area and (usually) 2 copies of the FAT linked list which are stored at the very beginning of the partition. Both were most likely overwritten entirely when you newfs'ed the slice. Once that is done, all your data is nothing more than millions of clusters scattered everywhere on the slice with no connection and identity.
The only *possible* solution is the one I already proposed: PhotoRec.
 
thanks Beastie. I recovered with PhotoRec and Get Data Recovery many of my files but before to reformat my HDD I wanted to try gpart of fdisk method described above.

Thanks again guys!
 
You must log in or register to reply here.
Back
Top