Data Recovery (reiserfs)

[Evilguru]

Today I was trying to format a USB disk as ext3, nice and simple, I thought. So I typed in the command and went off. Only when I came back had I realised that I had formatted the wrong disk (/dev/sdc1 instead of /dev/sdd1).

So, I am interested in what I need to do to get as much of the data back as possible, there was nothing vitally important, just some stuff I would rather have than not have. I know that some of it will be totally gone, but most of it should still be there, right?

So what do I need to do to recover it?

Regards, Freddie.

[NeddySeagoon]

Evilguru,

First make a copy of the space, you cannot recover anything in situ.
Looking around with sleuthkit may help but only ever mount the remains read only.

If you know some fragments that you can grep the space for, you can locate files using hexedit.
Its a long slow process. Search the forums for other posts by me on the topic, there have been a few recovery threads like this over the years.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[Evilguru]

So there is no application that will have a stab at recovering as much as possible from the drive or try to re-build the directory structure?

[NeddySeagoon]

Evilguru,

I don't know of one, the problem is the list of inodes belonging to a file is not preserved, so it can't be recreated
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[frostschutz]

Don't do experiments on the drive, make them on a copy (or on the copy of the copy if you must).
Make backups in the future.

I'd try fsck.reiserfs. May sound silly, but there may be a backup superblock somewhere you can use to restore the full structure of the reiserfs. I don't know where reiserfs keeps those (if any) as I don't use this particular fs, but it's a possibility you should look into.

If that doesn't work, you've got no choice but to do a bit of forensics voodoo. Forget locating files with hexedit - you won't find anything unless you know exactly what (and better yet where) to look for it. Unless you're looking for a very specific text file and you know some of its contents you can search for, using a hexeditor is simply not viable.

There are tools that go through raw data and extract what they think are useful bits and pieces of information. I've had some luck with anyfs, it can extract some common file types like jpeg images and word documents. There are several tools like that, I suggest you try them all and see what you can find.

[Evilguru]

Should I format it as reiserfs first, or just fsck it?

Regards, Freddie.

[NeddySeagoon]

Evilguru,

Don't touch the drive at all. Anything you do in situ can only make it worse.
I agree that you need something to search for with hexedit. However, many binary files have a plain text header, which gives you something to go on. You get a lot a false positives with a short search fragment.

I don't know anyfs at all but it must make some assumptions about where to find subsequent blocks in a filesystem if it can recover who;e files. reiserfs will be difficult because of the way it uses the otherwise wasted space in the last block of a file. Most other filesystems begin files on a block boundary.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[frostschutz]

[NeddySeagoon]

frostschutz,

That sounds really useful - I'll have a play with it before I really need it.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.