Re: Deleted Partition Recovery ?
On Mon, 2004-12-13 at 14:50 +0800, Nazri Ramliy wrote: > This is just an overview, the details are of course not as easy at it > sounds - you'll have to find/come up with a program/script to do a > scan thru the hard disk image and extract the pictures. jpeg/gif > files have headers somewhere at their beginning that you can use to > tell how many bytes made up the picture so the tool can extract that > amount of bytes plus the headers and save them into a new file (you > might not be able to retrieve their original file names, though). > Some perl junkie with enough interest could come up with the script, > (i'm not a perl junkie myself). > > Kind regards, > > Nazri Ramliy > > There's several already: The Sleuth Kit and Autopsy (a gui frontend for the Sleuth Kit) are available via apt-get. I've never actually used them though. Another one, which I have used, is foremost (http://foremost.sourceforge.net/). It's not brilliant but it works; it might work better if you understand how to configure it. (I should probably make sure I'm sending something to the list, not an individual, before sending it. Sorry. :-( ) -- -Benjamin Matthew A'Lee Public Key: BEC9DC1A Termisoc Secretary: http://www.termisoc.org/ Home Page: http://benalee.co.uk/ signature.asc Description: This is a digitally signed message part
Re: Deleted Partition Recovery ?
On Sun, Dec 12, 2004 at 12:11:34PM -0600, Matthew Quigley wrote: > I've used get data back to recover lost files, costs about $70.00us > > > > >> > > On Sun, 2004-12-12 at 16:35 +0500, Nayyar Ahmed wrote: > >> > > > Hello All, > >> > > > > >> > > > One of my PC have two hard-disks, one is used for > >> > > > Linux and other for M$ windows, My young brother > >> > > > unfortunatly have deleted the partitions of that > >> > > > M$ windows hard-disk and by using FDISK(DOS) > >> > > > have developed a single FAT32 partition of that hard-disk. If you choose not to pay that $70.00us, then you can try recovering those pictures own your own (this is the hard way). You'll need a big fat hard disk for storing an image of the hard disk that you your brother fused. Get the image of the fused hardisk using dd, then scavenge the image for any picture files (jpeg/bmp/gif/etc) and extract them one by one. This is just an overview, the details are of course not as easy at it sounds - you'll have to find/come up with a program/script to do a scan thru the hard disk image and extract the pictures. jpeg/gif files have headers somewhere at their beginning that you can use to tell how many bytes made up the picture so the tool can extract that amount of bytes plus the headers and save them into a new file (you might not be able to retrieve their original file names, though). Some perl junkie with enough interest could come up with the script, (i'm not a perl junkie myself). Kind regards, Nazri Ramliy -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Deleted Partition Recovery ?
I've used get data back to recover lost files, costs about $70.00us > > > On Sun, 2004-12-12 at 16:35 +0500, Nayyar Ahmed wrote: > > > > Hello All, > > > > > > > > One of my PC have two hard-disks, one is used for > > > > Linux and other for M$ windows, My young brother > > > > unfortunatly have deleted the partitions of that > > > > M$ windows hard-disk and by using FDISK(DOS) > > > > have developed a single FAT32 partition of that hard-disk. > > some windoze version keep a backup partition table ... > > - find a windoze nutcase(guru) to restore the original partition table > > -- lesson > - print out the partition table and save it on a piece > of paper glued/taped to the disk > > fdisk -l /dev/hda | lpr If people are still worried about this, I think making back up binary copy to Floppy may halp. # dd if=/dev/hda of=/dev/fd0 block=512 count=2 THis always gives you complete recovery for base partition. Oh, some knopix like CD will be nice to have to use thjis. Now d-i CD is not as easy to use for recovery. Osamu PS: Giving hardware access from console is sure call for trouble if your brother or even your self are smart enough to make trouble. They can do real damage like I have done to myself. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Deleted Partition Recovery ?
On Sun, Dec 12, 2004 at 05:59:52AM -0800, Alvin Oga wrote: > > > On Sun, 12 Dec 2004, Frank Gevaerts wrote: > > > On Sun, Dec 12, 2004 at 06:12:39AM -0600, Ron Johnson wrote: > > > On Sun, 2004-12-12 at 16:35 +0500, Nayyar Ahmed wrote: > > > > Hello All, > > > > > > > > One of my PC have two hard-disks, one is used for > > > > Linux and other for M$ windows, My young brother > > > > unfortunatly have deleted the partitions of that > > > > M$ windows hard-disk and by using FDISK(DOS) > > > > have developed a single FAT32 partition of that hard-disk. > > some windoze version keep a backup partition table ... > > - find a windoze nutcase(guru) to restore the original partition table > > -- lesson > - print out the partition table and save it on a piece > of paper glued/taped to the disk > > fdisk -l /dev/hda | lpr If people are still worried about this, I think making back up binary copy to Floppy may halp. # dd if=/dev/hda of=/dev/fd0 block=512 count=2 THis always gives you complete recovery for base partition. Oh, some knopix like CD will be nice to have to use thjis. Now d-i CD is not as easy to use for recovery. Osamu PS: Giving hardware access from console is sure call for trouble if your brother or even your self are smart enough to make trouble. They can do real damage like I have done to myself. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Deleted Partition Recovery ?
On Sun, 12 Dec 2004, Frank Gevaerts wrote: > On Sun, Dec 12, 2004 at 06:12:39AM -0600, Ron Johnson wrote: > > On Sun, 2004-12-12 at 16:35 +0500, Nayyar Ahmed wrote: > > > Hello All, > > > > > > One of my PC have two hard-disks, one is used for > > > Linux and other for M$ windows, My young brother > > > unfortunatly have deleted the partitions of that > > > M$ windows hard-disk and by using FDISK(DOS) > > > have developed a single FAT32 partition of that hard-disk. some windoze version keep a backup partition table ... - find a windoze nutcase(guru) to restore the original partition table -- lesson - print out the partition table and save it on a piece of paper glued/taped to the disk fdisk -l /dev/hda | lpr c ya alvin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Deleted Partition Recovery ?
On Sun, 2004-12-12 at 16:35 +0500, Nayyar Ahmed wrote: > Hello All, > > One of my PC have two hard-disks, one is used for > Linux and other for M$ windows, My young brother > unfortunatly have deleted the partitions of that > M$ windows hard-disk and by using FDISK(DOS) > have developed a single FAT32 partition of that hard-disk. > > Problem was created when he told me that our all family photo > albums were in that deleted partitions, I am un-able to recover those > lost directories. Is there any solution to my problem ? He deleted multiple small DOS partitions, and successfully, validly created 1 big partition? If so, blech. If you remember *exactly* how the disk was partitioned beforehand, maybe you could recreate those files by recreating the partitions and running "Norton Undelete" on that partition. Or... you could restore your photo albums from backups. You have backups, right? -- - Ron Johnson, Jr. Jefferson, LA USA PGP Key ID 8834C06B I prefer encrypted mail. Why jobs are being out-sourced to 2nd & 3rd world nations: Unions and Liberalism. Unions for a general raising of wages, and Liberalism for the creation of The Nanny State, which creates a *relatively* high minimum wage, and *lots* of well meaning regulations that drive up employment costs. Lastly, Unions, Liberalism and it's offspring "the Me Generation" have destroyed the educational system, at the same time that 2nd & 3rd world nations are pumping out millions of highly educated people who can live like princes on a fraction of US or Western European wages. signature.asc Description: This is a digitally signed message part
Re: Deleted Partition Recovery ?
On Sun, 2004-12-12 at 13:43 +0100, Frank Gevaerts wrote: > On Sun, Dec 12, 2004 at 06:12:39AM -0600, Ron Johnson wrote: > > On Sun, 2004-12-12 at 16:35 +0500, Nayyar Ahmed wrote: > > > Hello All, > > > > > > One of my PC have two hard-disks, one is used for > > > Linux and other for M$ windows, My young brother > > > unfortunatly have deleted the partitions of that > > > M$ windows hard-disk and by using FDISK(DOS) > > > have developed a single FAT32 partition of that hard-disk. > > > > > > Problem was created when he told me that our all family photo > > > albums were in that deleted partitions, I am un-able to recover those > > > lost directories. Is there any solution to my problem ? > > > > He deleted multiple small DOS partitions, and successfully, > > validly created 1 big partition? If so, blech. > > > > If you remember *exactly* how the disk was partitioned beforehand, > > maybe you could recreate those files by recreating the partitions > > and running "Norton Undelete" on that partition. > > You could also try gpart, a tool that scans your disk looking for known > filesystem beginnings. However, if he also formatted the new partition, > I guess it will be difficult. Yeah, that's the problem. There already *is* a valid partition. -- - Ron Johnson, Jr. Jefferson, LA USA PGP Key ID 8834C06B I prefer encrypted mail. "If thine enemy offend thee, give his child a drum." Chinese Curse signature.asc Description: This is a digitally signed message part
Re: Deleted Partition Recovery ?
Le Sun, Dec 12, 2004 at 07:08:51AM -0600, Ron Johnson ecrit : > > You could also try gpart, a tool that scans your disk looking for known > > filesystem beginnings. However, if he also formatted the new partition, > > I guess it will be difficult. > Yeah, that's the problem. There already *is* a valid partition. ---end quoted text / fin de citation--- If the formatting was "quick", gpart might work. the tools that might help you are dd_rescue, dd_rhelp and gpart. Fanfan -- L'amour, c'est d'abord aimer follement l'odeur de l'autre. [Pascal Quignard] signature.asc Description: Digital signature
Re: Deleted Partition Recovery ?
On Sun, Dec 12, 2004 at 06:12:39AM -0600, Ron Johnson wrote: > On Sun, 2004-12-12 at 16:35 +0500, Nayyar Ahmed wrote: > > Hello All, > > > > One of my PC have two hard-disks, one is used for > > Linux and other for M$ windows, My young brother > > unfortunatly have deleted the partitions of that > > M$ windows hard-disk and by using FDISK(DOS) > > have developed a single FAT32 partition of that hard-disk. > > > > Problem was created when he told me that our all family photo > > albums were in that deleted partitions, I am un-able to recover those > > lost directories. Is there any solution to my problem ? > > He deleted multiple small DOS partitions, and successfully, > validly created 1 big partition? If so, blech. > > If you remember *exactly* how the disk was partitioned beforehand, > maybe you could recreate those files by recreating the partitions > and running "Norton Undelete" on that partition. You could also try gpart, a tool that scans your disk looking for known filesystem beginnings. However, if he also formatted the new partition, I guess it will be difficult. Frank -- "Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it." - Brian W. Kernighan -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Deleted Partition Recovery ?
Hello All, One of my PC have two hard-disks, one is used for Linux and other for M$ windows, My young brother unfortunatly have deleted the partitions of that M$ windows hard-disk and by using FDISK(DOS) have developed a single FAT32 partition of that hard-disk. Problem was created when he told me that our all family photo albums were in that deleted partitions, I am un-able to recover those lost directories. Is there any solution to my problem ? TIA Regards, -- Nayyar Ahmad Lecturer Faculty Of Computer Science, Institute Of Management Sciences, Hayat Abad Peshawar , Pakistan. Office : 92-091-9217404 , 9217452 Cell : 92-0333-9139461 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
