Saturday, June 10, 2017

linux - Recovering ext4 data after accidental partial re-image?


I had a CD that automatically starts to image a system with windows XP/NTFS. Accidentally booted from it on a Linux system which has one large ext4 partition (500GB). Interrupted the imaging process after about 3-4 seconds.


I would imagine the file table is gone since there was enough time to write at least 100MB to disk. However, I have heard of some kind of superblock backup on ext4(?) Any software/process to recover the non-overwritten files from the damaged ext4 partition?


Answer



Your best bet is to give it a try. The backup superblock should be intact, so boot from a live CD if the OS is toast, and run


/sbin/fsck.ext4 /dev/

If something more in-depth is required, then taking this step could make matters worse, so if you have space somewhere else, you could make a security byte level copy first to another disk with a partition the same size on it:


dd if=/dev/ of=/dev/ bs=1M

If your imaging process reparitioned the disk, then you can rebuild the partition table without deleting data with fdisk or parted, provided you know the layout that was used.


No comments:

Post a Comment

hard drive - Leaving bad sectors in unformatted partition?

Laptop was acting really weird, and copy and seek times were really slow, so I decided to scan the hard drive surface. I have a couple hundr...