harddrive data recovery [SOLVED]

[dmpogo]

Ok, sooner or later it had to happen and I did lost my backup (and some other) data by moving disks to another raid-1 enclosure (don't ask why).

So now I have a disk with the partition table gone, it looks empty to fdisk. However if I try to create a partition at standard block 2048, it says that there is reiserfs signature,
and do I want to delete it ? So I guess that if I just create a sifficiently large partition, I'll probably get the data from it still intact.

However, the problem is that I had two partitions on that disk. And it is the second one that is more valuable. But I do not know at what block starts.
With the first partition I could make it to cover the whole disk, it will obviously be more than before, and I feel I have a chance to see the data. But that will screw the second partition, perhaps finally.

So the question is, can I find where the second partition was starting ? I would think that somewhere at its start there is the reiserfs signature as well, so is there a way to find it ?

[quilosaq]

I think it is impossible to find that data manually. Maybe this article can help:
https://wiki.gentoo.org/wiki/TestDisk

Don't forget to activate the use flag reiserfs in testdisk

[szatox]

It certainly is possible.
First, you do have a copy of this disk,don't you? It would suck if you accidentally damaged the data wile trying to recover it.
Second, people usually partition disks without any gaps, and at least some filesystems know how big they are supposed to be. If you can read that from your the FS on your first partition, it will be a good clue about the location of your second partition. Tools for resizing the FS might help.
Third, yes, scanning the whole disk is an option too. FS are structured, so you can find a location of stuff if you know what you're looking for. Signature is certainly a good pointer, even though there will likely be a bunch of false-positives.

Partition table is just a bunch of pointers, losing it, although inconvenient, doesn't immediately delete your data, and with raid 1 each disk can be read as an individual device, so it should be fairly easy to recover. It is weird that you lost your partition table though. Made a mistake witch overwrote your headers with raid's superblock or something?
_________________
Make Computing Fun Again

[NeddySeagoon]

dmpogo,

You want the mount option -o offset=.
If your drive is /dev/sda, try

[dmpogo]

Thanks Neddy !

I did find last night that testdisk utility and run it to see what it finds. It does find two Linux partitions, seemingly of correct sizes, and reports the starting blocks in CHS format.
Then it finds some FAT16 stuff which it fails to read and which exceeds the disk size. However it is happy to recover the first partition, but says that cannot do the second (also complains that
the disk is too small, perhaps because of fat16). I stopped at that stage.

Both my partitions were primary, I thought that I do not have extended/logical one on this disk.
But somehow, from my memory, partitions were always detected as /dev/sb1 and /dev/sb3, so now I wonder if I did have extended /dev/sb2 ?
I'll be working on your suggestions. It is a great idea to everything on the disk image !

[NeddySeagoon]

dmpogo,

With an MSDOS partition table, it's perfectly possible and legal, to have gaps in the primary partition entries.
The same is true of GPT.

If you don't use the partition table and use mount -o offset= you can establish the size of the first filesystem then fish for a filesystem that starts just off the end of the first one.
No partition table needed.

With a disk image, works just the same. If your image has a partition table,

[szatox]

[dmpogo]

Ok, Neddy's mount -o offset="" successfully works, all the data seems there

Now the last question, I can create a partition starting at the offset upto the end of the disk, done that before resizing the partitions.
Is there any way to make sure that partition will not come out shorter than before and screw the filesystem ?
(i.e that I did not get some reserved blocks at the end which were not there before, or something)

If I could shrink the filesystem a bit, but
it looks like I can't realliy manipulate the filesystem if I do not have a device, and mount it via offset.

[NeddySeagoon]

dmpogo,

The partition table entry is only a pointer. If you make pigs ear of it, no user data will be affected unless you make and use another partition that would use some of the space of the first filesystem a second time.
That is, making the partition too small, on its own, is harmless.

If you do make it too small, mount will tell you all about it.

You are working in a disk image ... or have a disk image in case you need an 'undo, ... don't you?

I think offset= uses a loop device ... so you do have a device. /dev/loopX.

[dmpogo]