On 5/13/05, Jeremy T. Bouse <[EMAIL PROTECTED]> wrote: > Quite a pickle you've found yourself in, this is a good example > for why not using root much is good. If at this time all you've done is > repartition and save the partition table then the data *should* still be > in tact on the drive. Experience with data forensics has taught me this.
Yes, but even if I had done a sudo, still I might have done the same thing. My fault was that I became careless in using the write command in fdisk. I shoould have double-checked. > As someone else mentioned if you have the *exact* partition > table configuration prior to this re-partitioning nitemare then you > should be able to simply re-parition and set it back up. In order to do > this you need to have the exact "Start" and "End" values for each > partition. If these are off you could risk losing the data in the > partition or that it may just not be available. > > Let me put the disclaimer out there that partitioning is a > destructive process by it's very nature. Just re-partitioning it as you > already have done *may* lose data (again it may not), and attempting to > correct it *may* lose data (again it may not). Just saying there is no > guarantee in anything dealing with re-partitioning. Someone mentioned that it's theoretically possible to reconstruct and get all data back. How much is it practically possible and what are the reasons for failure, provided I do it very methodically and have the exact partition info? When does this "may lose data" come in to picture? Please explain. > Provided the Knoppix LiveCD has fdisk available, and provided > you have the exact partition table information from before the failure > you should be able to boot off the CD and correct the partition table. > Again while running under the LiveCD you should be able to attempt > mounting the partitions *ONE-BY-ONE* in *READ-ONLY* mode without running > fsck to see if the data is still there. The read-only mode and not > running fsck is to make sure that nothing is attempted to be written to > the drive. If this all succeeds then reboot again under the LiveCD and > test the partition data again to make sure it passes a "reboot test" and > is still available before attempting to boot it up under it's own power. > You may need to have a LILO or GRUB boot-floppy available if the MBR was > modified so as to make it non-bootable. Well, I have the exact partition info at hand (Now I have written it down in my diary too so later it's handy just in case.) Okay I will mount the partitions RO and one by one. Could you please clarify what do you mean by a "reboot test". Just checking on the data is okay? Do I still need to have a grub floppy even tho I never repartitioned this after the first time? > There is a risk of data loss, which comes with dealing with > re-partitioning but if you have accurate records of the prior partition > table and proceeed methodically and logically you can limit those risks. > I do not advice doing anything mentioned if you do not feel confident in > any of the steps necessary or the information you have on the partition > table. If you have an extra machine you could test with that you aren't > worried with the data, you could attempt it on there before trying it on > the machine in question. I would try it myself here if I had such a > machine, but unfortunately the only way I could do so would be through > VMware which might not be entirely accurate. Thanks Jeremy. I will attempt this first on a spare hard disk as mentioned earlier. I'm installing this Knoppix on to it (save the fdisk info) and then will fdisk it and make one solaris partition as I did on the drive in question, and then try the recovery. Do I need to have another machine for this? Regards, Deboo -- Please don't Cc: me, I'm subscribed to the list.