Re: Backing up critical data ((was Re: Please help: Accidentally wiped off the whole hard disk!!!)
Marty wrote: > Along the general lines of backing up systems and critical data, > there's also the dpkg (or apt) option to produce a list of packages > that can be used to reproduce a complete debian installation. > (I don't have it at my fingertips. Can anyone refresh my memory?) Here it is, dpkg --get-selections '*' > pkg.lst To restore, use dpkg --set-selections < pkg.lst -- Cheers, Sven Arvidsson http://www.whiz.se PGP Key ID 760BDD22 signature.asc Description: Digital signature
Backing up critical data ((was Re: Please help: Accidentally wiped off the whole hard disk!!!)
Karsten M. Self wrote: on Fri, May 13, 2005 at 02:16:22PM -0600, Glenn English ([EMAIL PROTECTED]) wrote: On Fri, 2005-05-13 at 15:09 -0400, Angelina Carlton wrote: > Just for those of us just following along, can I use fdisk to record > the EXACT information on my currently working systems to a file, and > be sure that file contained enough information to rebuild the > partition table if ever needed? Is there a tool/command to do this? > fdisk has quite a few options so I was courious about some > preventative measures. The tools I use are the p command in fdisk, and a pencil and paper. Then I stick it on the wall with a thumbtack. I create a script to document system settings, then post that to my Wiki: http://twiki.iwethey.org/Main/LinuxSystemInfoScript ...and have even used same to reconstruct a partition table. Once. Bindered hardcopy is also tres helpful. Peace. Thanks. That looks interesting. Along the general lines of backing up systems and critical data, there's also the dpkg (or apt) option to produce a list of packages that can be used to reproduce a complete debian installation. (I don't have it at my fingertips. Can anyone refresh my memory?) Secondly, if you take that list, and combine it with your data which has been stored based on the output of the "cruft" command, or something similar, then is seems that by combining these two commands with a few scripts, it may be possible to backup only personal files, thus saving lots of backup space. Does anyone know if this is being done already, or have any comments? (Currently I'm using backuppc but I have noticed that the vast majority of space for backups is various system files.) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
on Fri, May 13, 2005 at 02:16:22PM -0600, Glenn English ([EMAIL PROTECTED]) wrote: > On Fri, 2005-05-13 at 15:09 -0400, Angelina Carlton wrote: > > > Just for those of us just following along, can I use fdisk to record > > the EXACT information on my currently working systems to a file, and > > be sure that file contained enough information to rebuild the > > partition table if ever needed? Is there a tool/command to do this? > > fdisk has quite a few options so I was courious about some > > preventative measures. > > The tools I use are the p command in fdisk, and a pencil and paper. Then > I stick it on the wall with a thumbtack. I create a script to document system settings, then post that to my Wiki: http://twiki.iwethey.org/Main/LinuxSystemInfoScript ...and have even used same to reconstruct a partition table. Once. Bindered hardcopy is also tres helpful. Peace. -- Karsten M. Self http://kmself.home.netcom.com/ What Part of "Gestalt" don't you understand? Marti wrote: News flash: / Matt Pavlovich does not live / in California. - Haiku Pavlovich signature.asc Description: Digital signature
Re: Strange: Linux boots off a deleted partition [Was Re: Please help: Accidentally wiped off the whole hard disk!!!]
On Sun, May 15, 2005 at 03:17:31AM -0400, Deboo ^ wrote: > I did a trial on a smaller hard disk. Installed knoppix on it, > rebooted from the hdd to test it. Rebooted again from the Live CD and > (after taking down the Linux partition info) deleted the partitions > and created just one partition, and changed the type to bf (Solaris) > -- the same thing which happened with the other hard disk. > > Now I tried booting off the hard disk just to check and it booted > without problems. Strange because when I check with fdisk, this is > what I see: > > [EMAIL PROTECTED]:~$ sudo fdisk -l /dev/hdc > > Disk /dev/hdc: 3227 MB, 3227148288 bytes > 255 heads, 63 sectors/track, 392 cylinders > Units = cylinders of 16065 * 512 = 8225280 bytes > >Device Boot Start End Blocks Id System >/dev/hdc1 1 392 3148708+ bf Unknown > > > There was one Linx partition and a Swap partition which I deleted. > > Can someone explain this behavior? If this hard disk boots alright > then why doesn't the other hard drive boot when the same thing > (accidentally) happened to it? Not so strange ;-) If you're using lilo as boot manager, it saves on bootsector where the linux kernel physically is. So, even after erasing partition table, lilo finds the kernel again. Your previous linux partition was the first one. You deleted the partition table, not the partitions themselves. So linux kernel tried to mount /dev/hda1 as a filesystem, and as your old and your new partitions start at the same point, it worked. You only lost your swap partition. Everything's clear now ;-) Regards, Cyprien -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Strange: Linux boots off a deleted partition [Was Re: Please help: Accidentally wiped off the whole hard disk!!!]
On Sun, 15 May 2005, Deboo ^ wrote: > Well, I just wanted to do a trial run of what I was to do on the drive > in question so I installed knoppix on this smaller drive, booted it to > test it is working, then booting off the knoppix CD again, I deleted > the partitions (the same thing that accidentally happened on the drive > in question). deleting the partition table after its been formatted still leaves the file system intact and functional if you have an alternative way ( knoppix ) to go looking at it how knoppix is finding the partition boundries is a separate issue, but my guess is, it's probably is looking at 0x448 - 0x512 and its corresponding entended partition definitions to recreate the "missing partition entries" > I created a single solaris partition and rebooted to > test the smaller hdd. But even after doing this twice, it still boots > without any problem booting the smaller disk should always work if you are using /dev/hda1 and no other partitions ( /tmp, /usr, /var, /opt, /home, (optional) /boot, ... ) > and right now I'm accessng the list thru the hdd > knoppx install which should not work (theoretically). it will(might) work ... knoppix does lots of [sanity] checking ... - and you;re saying it is booting off a disk that does NOT have any defined partitions, which was deleted after you had installed linux on it you're saying: "fdisk -l /dev/hda" is empty than there is no partitions defined, but i think there it could still work if the MBR is intact and the formated fs c ya alvin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Strange: Linux boots off a deleted partition [Was Re: Please help: Accidentally wiped off the whole hard disk!!!]
Deboo ^ wrote: I was already wared about such a thing and that's why I did this small trial. But now I am stuck what to do to get the data back ... other than by getting a newer hard drive ...which would be hard on the pocket for me. Again, attempting to duplicate a problem like this is problematic at best. I still think the fastest way to resolve the problem is direct examination of the disk, with a good disk editor. If I understand you correctly and your problem is not being confident of the fdisk -l output, then I would think the next step is to simply confirm everything you think you know about the problem by looking at the disk itself. This will enable you to verify what you suppose to be the correct partition table parameters. Then it should be safe to just fdisk the correct parameters and try to mount the drive read-only. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Strange: Linux boots off a deleted partition [Was Re: Please help: Accidentally wiped off the whole hard disk!!!]
On 5/15/05, Marty <[EMAIL PROTECTED]> wrote: > Deboo ^ wrote: > > I did a trial on a smaller hard disk. Installed knoppix on it, > > rebooted from the hdd to test it. Rebooted again from the Live CD and > > (after taking down the Linux partition info) deleted the partitions > > and created just one partition, and changed the type to bf (Solaris) > > -- the same thing which happened with the other hard disk. > > > > Now I tried booting off the hard disk just to check and it booted > > without problems. Strange because when I check with fdisk, this is > > what I see: > > > > [EMAIL PROTECTED]:~$ sudo fdisk -l /dev/hdc > > > > Disk /dev/hdc: 3227 MB, 3227148288 bytes > > 255 heads, 63 sectors/track, 392 cylinders > > Units = cylinders of 16065 * 512 = 8225280 bytes > > > >Device Boot Start End Blocks Id System > >/dev/hdc1 1 392 3148708+ bf Unknown > > > > > > There was one Linx partition and a Swap partition which I deleted. > > > > Can someone explain this behavior? If this hard disk boots alright > > then why doesn't the other hard drive boot when the same thing > > (accidentally) happened to it? > > > > Regards, > > Deboo > > The most obvious explanation is that the swap partition on your other > drive started at the first cylinder, but life is usually not that simple. > > Beyond that is guesswork, but in your first post you mentioned something > about having two drives when you thought only one was installed. You may > still not understand some problem in your original coinfiguration, making > adequate duplication of the original problem difficult at best. > > It's not clear what you are trying to accomplish. In another post you > claim to have the necessary partition table parameters to fix your > problem. > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] Well, I just wanted to do a trial run of what I was to do on the drive in question so I installed knoppix on this smaller drive, booted it to test it is working, then booting off the knoppix CD again, I deleted the partitions (the same thing that accidentally happened on the drive in question). I created a single solaris partition and rebooted to test the smaller hdd. But even after doing this twice, it still boots without any problem and right now I'm accessng the list thru the hdd knoppx install which should not work (theoretically). There's no data to be worried about on this smaller drve but since on this drive, even after repartitioning twice, it's booting without a bit of any errors, I am not confident to proceed with setting the original partitions on the drive in question (even when I have the exact partition info). If I had a spare drive of a similar size or more (40 GB), I would have backed it up with dd but since I do not have, I tried this method and would have gone ahead with the 40GB drive if this smaller drive hadn't created problems. It's "not deleting" the partition is a worry ... an unpredictable thing which doesn't assure me that I would get back my partions on the 40GB drive if even if I put in the exact info. I was already wared about such a thing and that's why I did this small trial. But now I am stuck what to do to get the data back ... other than by getting a newer hard drive ...which would be hard on the pocket for me. Regards, Deboo P.S.: If you read the last few posts by me in that other post, you'll know why I did this. Sorry if I have confused anyone. -- Please don't Cc: me, I'm subscribed to the list.
Re: Strange: Linux boots off a deleted partition [Was Re: Please help: Accidentally wiped off the whole hard disk!!!]
Deboo ^ wrote: I did a trial on a smaller hard disk. Installed knoppix on it, rebooted from the hdd to test it. Rebooted again from the Live CD and (after taking down the Linux partition info) deleted the partitions and created just one partition, and changed the type to bf (Solaris) -- the same thing which happened with the other hard disk. Now I tried booting off the hard disk just to check and it booted without problems. Strange because when I check with fdisk, this is what I see: [EMAIL PROTECTED]:~$ sudo fdisk -l /dev/hdc Disk /dev/hdc: 3227 MB, 3227148288 bytes 255 heads, 63 sectors/track, 392 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/hdc1 1 392 3148708+ bf Unknown There was one Linx partition and a Swap partition which I deleted. Can someone explain this behavior? If this hard disk boots alright then why doesn't the other hard drive boot when the same thing (accidentally) happened to it? Regards, Deboo The most obvious explanation is that the swap partition on your other drive started at the first cylinder, but life is usually not that simple. Beyond that is guesswork, but in your first post you mentioned something about having two drives when you thought only one was installed. You may still not understand some problem in your original coinfiguration, making adequate duplication of the original problem difficult at best. It's not clear what you are trying to accomplish. In another post you claim to have the necessary partition table parameters to fix your problem. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Deboo writes: > Someone mentioned that it's theoretically possible to reconstruct and get > all data back. Nothing theoretical about it. If all you did was repartition all you did was write a new partition table to the MBR. The data was not touched. Put the MBR back the way it was and you're fine. > How much is it practically possible... If you only altered the MBR you can recover everything. > ...what are the reasons for failure, provided I do it very methodically > and have the exact partition info? When does this "may lose data" come in > to picture? Please explain. You made a mistake once: you might do so again. The hardware might fail. The software might have a bug. Back up the disk with dd before you start (if possible). -- John Hasler -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Strange: Linux boots off a deleted partition [Was Re: Please help: Accidentally wiped off the whole hard disk!!!]
I did a trial on a smaller hard disk. Installed knoppix on it, rebooted from the hdd to test it. Rebooted again from the Live CD and (after taking down the Linux partition info) deleted the partitions and created just one partition, and changed the type to bf (Solaris) -- the same thing which happened with the other hard disk. Now I tried booting off the hard disk just to check and it booted without problems. Strange because when I check with fdisk, this is what I see: [EMAIL PROTECTED]:~$ sudo fdisk -l /dev/hdc Disk /dev/hdc: 3227 MB, 3227148288 bytes 255 heads, 63 sectors/track, 392 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/hdc1 1 392 3148708+ bf Unknown There was one Linx partition and a Swap partition which I deleted. Can someone explain this behavior? If this hard disk boots alright then why doesn't the other hard drive boot when the same thing (accidentally) happened to it? Regards, Deboo -- Please don't Cc: me, I'm subscribed to the list.
Re: Please help: Accidentally wiped off the whole hard disk!!!
Disks? Who needs Disks? http://www.bash.org/?98 i don't have hard drives. i just keep 30 chinese teenagers in my basement and force them to memorize numbers -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
On Sat, May 14, 2005 at 09:59:32PM -0400, Marty wrote: > > The format of the MBR and the fake partition table sectors is documented > in various books about PC hardware, and probably on the web, except for > the details of logical partition table chains which seem hard to find. > Hopefully you won't have to go there. > Andries Brouwer used to have a FAQ on partitioning, yes, including logical partition chains and the like. You might be able to google it, especially knowing the author's name. It also describes the many different kludges used from time to time to access ever-larger hard disks as the number of address bits keeps being incremented by just barely enough to last the next year or two. -- hendrik > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact > [EMAIL PROTECTED] > -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Deboo ^ wrote: On 5/13/05, Marty <[EMAIL PROTECTED]> wrote: Deboo ^ wrote: > I accideantally fdisked my linux hard disk and deleted all > partitions, created one single solaris partition. If you ever ran lilo on a root partition of the disk, then it probably saved a copy of the mbr in the /boot directory which can be manually restored with a disk editor (for example), although I'm not sure about the multiple disk scenario you describe, or about grub. Does this mean that lilo is better than grub due to this feature? Is there such an option configurable in grub? I'm not familiar with grub, but it probably has similar options. If all else fails, there are a number of ways to deduce and restore the correct partition table entries, either manually via inspection of the disk contents, or using various automatic recovery tools, or even by trial and error. I'll be interested to know these number of ways, if you could put these in short, later. Regards, Deboo gpart is one that have mentioned. From another posting it sounds like you already have the necessary partition information, in which case you should probably just replace the partition table with fdisk using the correct parameters. The following is just for your information or in case you are unsure of your existing partition info: Other tools I've heard of are partition magic (which I'm unfamiliar with) and the venverable Norton's Utilities. The latter had a disk editor with a partition table editing feature. These and many other tools allow you to backup entire partition table chains. Debian has a disk editor named LDE, and perhaps others. I am not familiar with any of them. The benefit of a disk editor is that it will enable you to do a pattern search for the characteristic patterns on the disk marking the start of the partitions, such as (from memory) the ending 0xAA55 pattern at the end of the first sector of each partition, which is similar to a MBR (partition table). If this has been wiped out, all is not lost, but you would have to search for other partition markers, such as the position of the first superblock, or the boot loader, and deduce the partition offset from that. The readable ASCII strings help identify these areas on the partition. The format of the MBR and the fake partition table sectors is documented in various books about PC hardware, and probably on the web, except for the details of logical partition table chains which seem hard to find. Hopefully you won't have to go there. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
On Sat, 2005-05-14 at 21:12 -0400, Deboo ^ wrote: > On 5/13/05, Marty <[EMAIL PROTECTED]> wrote: > > Deboo ^ wrote: > > > I accideantally fdisked my linux hard disk and deleted all > > > partitions, created one single solaris partition. > > > > If you ever ran lilo on a root partition of the disk, then it probably saved > > a copy of the mbr in the /boot directory which can be manually restored with > > a disk editor (for example), although I'm not sure about the multiple disk > > scenario you describe, or about grub. > > Does this mean that lilo is better than grub due to this feature? Is > there such an option configurable in grub? > > > If all else fails, there are a number of ways to deduce and restore the > > correct > > partition table entries, either manually via inspection of the disk > > contents, > > or using various automatic recovery tools, or even by trial and error. > > I'll be interested to know these number of ways, if you could put > these in short, later. No! Write it down and hang it on the wall above the console! So when you look up in horror after realizing what you've done, the fix will be the first thing you see. Much easier and faster than running a program to scan the disk and figure out the partitions. -- Glenn English [EMAIL PROTECTED] GPG ID: D0D7FF20 signature.asc Description: This is a digitally signed message part
Re: Please help: Accidentally wiped off the whole hard disk!!!
On Sat, 2005-05-14 at 21:06 -0400, Deboo ^ wrote: > On 5/13/05, Jeremy T. Bouse <[EMAIL PROTECTED]> wrote: > > Quite a pickle you've found yourself in, this is a good example > > for why not using root much is good. If at this time all you've done is > > repartition and save the partition table then the data *should* still be > > in tact on the drive. Experience with data forensics has taught me this. > > Yes, but even if I had done a sudo, still I might have done the same > thing. My fault was that I became careless in using the write command > in fdisk. I shoould have double-checked. My own problem is in telling the difference between drives. At least Linux calls them hda and sda (I usually have a SCSI drive on the / dir(s), and an IDE for a cheap black hole). BSD calls them 'ad' and 'da'! Dyslexics of the world untie :-) This thread is also an argument for partitioning disks the way my laptop is: All one partition. At least it's easy to remember... -- Glenn English [EMAIL PROTECTED] GPG ID: D0D7FF20 signature.asc Description: This is a digitally signed message part
Re: Please help: Accidentally wiped off the whole hard disk!!!
On 5/13/05, Angelina Carlton <[EMAIL PROTECTED]> wrote: > On Fri, May 13, 2005 at 02:32:16PM -0400, Marty wrote: > > Deboo ^ wrote: > > >I accideantally fdisked my linux hard disk and deleted all > > >partitions, created one single solaris partition. > > > > If you ever ran lilo on a root partition of the disk, then it probably saved > > a copy of the mbr in the /boot directory which can be manually restored with > > a disk editor (for example), although I'm not sure about the multiple disk > > scenario you describe, or about grub. > > > > Furthermore this will only work if you did not repartition the drive after > > running lilo, but even if you did, at least the root partition at that > > time should still be recoverable assuming you didn't do anything fancy in > > the meantime, like resize the root partition with parted. > > > > If all else fails, there are a number of ways to deduce and restore the > > correct > > partition table entries, either manually via inspection of the disk > > contents, > > or using various automatic recovery tools, or even by trial and error. > > > > > > Just for those of us just following along, can I use fdisk to record > the EXACT information on my currently working systems to a file, and > be sure that file contained enough information to rebuild the > partition table if ever needed? Is there a tool/command to do this? > fdisk has quite a few options so I was courious about some > preventative measures. > > Deboo I REALLY hope you get this fixed btw. > > -- > Angelina Carlton Thanks Angelina and everyone else, for these good wishes. I hope to get this recovered today. I postponed it to do it today, Sunday. Anyway, as I mentioned earlier, I would say that it's better to jot down the partition info in to your diary rather than just save on disk. I was lucky to have saved this info before. Regards, Deboo -- Please don't Cc: me, I'm subscribed to the list.
Re: Please help: Accidentally wiped off the whole hard disk!!!
On 5/13/05, Marty <[EMAIL PROTECTED]> wrote: > Deboo ^ wrote: > > I accideantally fdisked my linux hard disk and deleted all > > partitions, created one single solaris partition. > > If you ever ran lilo on a root partition of the disk, then it probably saved > a copy of the mbr in the /boot directory which can be manually restored with > a disk editor (for example), although I'm not sure about the multiple disk > scenario you describe, or about grub. Does this mean that lilo is better than grub due to this feature? Is there such an option configurable in grub? > If all else fails, there are a number of ways to deduce and restore the > correct > partition table entries, either manually via inspection of the disk contents, > or using various automatic recovery tools, or even by trial and error. I'll be interested to know these number of ways, if you could put these in short, later. Regards, Deboo -- Please don't Cc: me, I'm subscribed to the list.
Re: Please help: Accidentally wiped off the whole hard disk!!!
On 5/13/05, Jeremy T. Bouse <[EMAIL PROTECTED]> wrote: > Quite a pickle you've found yourself in, this is a good example > for why not using root much is good. If at this time all you've done is > repartition and save the partition table then the data *should* still be > in tact on the drive. Experience with data forensics has taught me this. Yes, but even if I had done a sudo, still I might have done the same thing. My fault was that I became careless in using the write command in fdisk. I shoould have double-checked. > As someone else mentioned if you have the *exact* partition > table configuration prior to this re-partitioning nitemare then you > should be able to simply re-parition and set it back up. In order to do > this you need to have the exact "Start" and "End" values for each > partition. If these are off you could risk losing the data in the > partition or that it may just not be available. > > Let me put the disclaimer out there that partitioning is a > destructive process by it's very nature. Just re-partitioning it as you > already have done *may* lose data (again it may not), and attempting to > correct it *may* lose data (again it may not). Just saying there is no > guarantee in anything dealing with re-partitioning. Someone mentioned that it's theoretically possible to reconstruct and get all data back. How much is it practically possible and what are the reasons for failure, provided I do it very methodically and have the exact partition info? When does this "may lose data" come in to picture? Please explain. > Provided the Knoppix LiveCD has fdisk available, and provided > you have the exact partition table information from before the failure > you should be able to boot off the CD and correct the partition table. > Again while running under the LiveCD you should be able to attempt > mounting the partitions *ONE-BY-ONE* in *READ-ONLY* mode without running > fsck to see if the data is still there. The read-only mode and not > running fsck is to make sure that nothing is attempted to be written to > the drive. If this all succeeds then reboot again under the LiveCD and > test the partition data again to make sure it passes a "reboot test" and > is still available before attempting to boot it up under it's own power. > You may need to have a LILO or GRUB boot-floppy available if the MBR was > modified so as to make it non-bootable. Well, I have the exact partition info at hand (Now I have written it down in my diary too so later it's handy just in case.) Okay I will mount the partitions RO and one by one. Could you please clarify what do you mean by a "reboot test". Just checking on the data is okay? Do I still need to have a grub floppy even tho I never repartitioned this after the first time? > There is a risk of data loss, which comes with dealing with > re-partitioning but if you have accurate records of the prior partition > table and proceeed methodically and logically you can limit those risks. > I do not advice doing anything mentioned if you do not feel confident in > any of the steps necessary or the information you have on the partition > table. If you have an extra machine you could test with that you aren't > worried with the data, you could attempt it on there before trying it on > the machine in question. I would try it myself here if I had such a > machine, but unfortunately the only way I could do so would be through > VMware which might not be entirely accurate. Thanks Jeremy. I will attempt this first on a spare hard disk as mentioned earlier. I'm installing this Knoppix on to it (save the fdisk info) and then will fdisk it and make one solaris partition as I did on the drive in question, and then try the recovery. Do I need to have another machine for this? Regards, Deboo -- Please don't Cc: me, I'm subscribed to the list.
Re: Please help: Accidentally wiped off the whole hard disk!!!
Deboo ^ wrote: > I have lots of data on it, useful data and lots of linux things I > wouldn't like to lose. Can someone help? I've had luck with gpart[1] in the past, it'll scan the disk and find any partition boundaries (oh the fun of accidentally writing a rescue floppy image to /dev/hda). [1] http://www.stud.uni-hannover.de/user/76201/gpart/ (there should be a package in debian/main too). -- Stephen Patterson [EMAIL PROTECTED] http://patter.mine.nu/ Linux Counter No: 142831 GPG Public key: E3E8E974 "Whoever said nothing is impossible never tried slamming a revolving door." -- Melissa O'Brien -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
On 5/13/05, Tony Godshall <[EMAIL PROTECTED]> wrote: > According to Lee Braiden, > > On Friday 13 May 2005 18:32, Deboo ^ wrote: > > > Since it's not yet formatted, I would think there must be a way to > > > recover all the data still. I could install this knoppix on the small > > > 3 GB hdd and connecting the big hdd, try to recover. Is there a > > > program I can use to recover the data? > > > > Yes, there is a program around for recovering partition tables. I just > > don't > > recall the name. But wait for someone to point you to it. In other words, > > don't get impatient and break stuff before you get a good answer ;) > > I used gpart once. > > Your milage may vary. > > Suggest you dd the whole drive to a backup file before you > try anything. Right now I do not have a backup drive to store so much but I do have another smaller driver (the one on which I installed Solaris). I could do a trial of whatever I wish to do on the drive in question, and then do the real thing after this trial succeeds. Btw, I got the file that has the partition information and it has the exaxt figures from fdisk -l. I think I'm half-saved now. But I'll do a trial of this on the smaller hdd anyway. If this fails, I won't go ahead with fdisk on the drive in question. One thing though. I had simply done a fdisk -l >> partitions.txt and that is the file I am going to use to reconstruct the partitions. Would these be the exact figures? I haven't partitioned the drive since the first time and I use grub so no lilo's backup. I have heard bad reports from a friend about gpart, so don't know if I should use it or not. Thanks and Regards, Deboo -- Please don't Cc: me, I'm subscribed to the list.
Re: Please help: Accidentally wiped off the whole hard disk!!!
According to Lee Braiden, > On Friday 13 May 2005 18:32, Deboo ^ wrote: > > Since it's not yet formatted, I would think there must be a way to > > recover all the data still. I could install this knoppix on the small > > 3 GB hdd and connecting the big hdd, try to recover. Is there a > > program I can use to recover the data? > > Yes, there is a program around for recovering partition tables. I just don't > recall the name. But wait for someone to point you to it. In other words, > don't get impatient and break stuff before you get a good answer ;) I used gpart once. Your milage may vary. Suggest you dd the whole drive to a backup file before you try anything. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: fdisk Re: Please help: Accidentally wiped off the whole hard disk!!!
Alvin Oga wrote: On Fri, 13 May 2005, Angelina Carlton wrote: Just for those of us just following along, can I use fdisk to record the EXACT information on my currently working systems to a file, and fdisk -l /dev/hda > /tmp/hda.fdisk.lst be sure that file contained enough information to rebuild the partition table if ever needed? yup Is there a tool/command to do this? yup fdisk has quite a few options so I was courious about some preventative measures. save that info to a piece of paper, since your disk may not be accessible at the time - and tape the paper to the disk or the PC - your your palm top or your floppy or anyplace else other than files on the disk itself c ya alvin The only caveat I see with this method is it may only be convenient of even possible with primary partitions. If you have extended and logical partitions you may have to reconstruct a broken partition table chain, and that's a much more complex task. Then its not enough to just save enough info to fix the MBR. I don't even know anywhere you can find documentation on these unless you have some of the original IBM PC manuals, which are so hard to find that they are now probably collectors items. For this reason I avoid extended partitions altogether, but this is hard to do becomes some distributions (not sure about Debian) seem to insist in using extended partitions by default. As a result a lot of newbies get burned by this problem and no simple way to restore their partition tables. (I always set up my partitions manually, and never let any automated tool do this job.) You should be fine if you stick with primary partitions, otherwise in addition to the MBR data it probably would be wise to save copies of *each* primary and extended partition table and its offset from the beginning of the disk, and possibly even the logical partition tables as well to reconstruct the logical partition table chain, in addition to the MBR. It's scary just thinking about it. On the other hand, I'm sure I've heard of various tools and disk editors that automate this process, but none are free that I know about. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Jeremy writes: > Let me put the disclaimer out there that partitioning is a destructive > process by it's very nature. Partitioning changes nothing but the partition table which is in the MBR. Nothing else on the disk is touched. -- John Hasler -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
On Fri, 2005-05-13 at 15:09 -0400, Angelina Carlton wrote: > Just for those of us just following along, can I use fdisk to record > the EXACT information on my currently working systems to a file, and > be sure that file contained enough information to rebuild the > partition table if ever needed? Is there a tool/command to do this? > fdisk has quite a few options so I was courious about some > preventative measures. The tools I use are the p command in fdisk, and a pencil and paper. Then I stick it on the wall with a thumbtack. When the disk is broken, having it on disk isn't much help. It always seems to be on the wrong disk. Or I can't boot the system to read the floppy. -- Glenn English [EMAIL PROTECTED] GPG ID: D0D7FF20 signature.asc Description: This is a digitally signed message part
fdisk Re: Please help: Accidentally wiped off the whole hard disk!!!
On Fri, 13 May 2005, Angelina Carlton wrote: > Just for those of us just following along, can I use fdisk to record > the EXACT information on my currently working systems to a file, and fdisk -l /dev/hda > /tmp/hda.fdisk.lst > be sure that file contained enough information to rebuild the > partition table if ever needed? yup > Is there a tool/command to do this? yup > fdisk has quite a few options so I was courious about some > preventative measures. save that info to a piece of paper, since your disk may not be accessible at the time - and tape the paper to the disk or the PC - your your palm top or your floppy or anyplace else other than files on the disk itself c ya alvin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
> Deboo ^ (<[EMAIL PROTECTED]>) wrote: > > > I accideantally fdisked my linux hard disk and deleted all > > partitions, created one single solaris partition. I wanted to do this > > on my second hard disk and thought I had connected the second one and > > disconnected the first, but hadn't disconnected the first one really. > > [...] > > Since it's not yet formatted, I would think there must be a way to > > recover all the data still. > > [...] your partition info is saved at 0x448 - 0x512 4 partitions of 16-bytes each if you used lilo, that info is also /boot/boot.0300 ( or whatever backup file it created for your partition scheme at the time lilo was installed ) dd if=/boot/boot.0300 of=/dev/hda bs=512 count=1 should restore your partitions ... but i didn't test it c ya alvin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
On Fri, May 13, 2005 at 02:32:16PM -0400, Marty wrote: > Deboo ^ wrote: > >I accideantally fdisked my linux hard disk and deleted all > >partitions, created one single solaris partition. > > If you ever ran lilo on a root partition of the disk, then it probably saved > a copy of the mbr in the /boot directory which can be manually restored with > a disk editor (for example), although I'm not sure about the multiple disk > scenario you describe, or about grub. > > Furthermore this will only work if you did not repartition the drive after > running lilo, but even if you did, at least the root partition at that > time should still be recoverable assuming you didn't do anything fancy in > the meantime, like resize the root partition with parted. > > If all else fails, there are a number of ways to deduce and restore the > correct > partition table entries, either manually via inspection of the disk > contents, > or using various automatic recovery tools, or even by trial and error. > > Just for those of us just following along, can I use fdisk to record the EXACT information on my currently working systems to a file, and be sure that file contained enough information to rebuild the partition table if ever needed? Is there a tool/command to do this? fdisk has quite a few options so I was courious about some preventative measures. Deboo I REALLY hope you get this fixed btw. -- Angelina Carlton -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Quite a pickle you've found yourself in, this is a good example for why not using root much is good. If at this time all you've done is repartition and save the partition table then the data *should* still be in tact on the drive. Experience with data forensics has taught me this. As someone else mentioned if you have the *exact* partition table configuration prior to this re-partitioning nitemare then you should be able to simply re-parition and set it back up. In order to do this you need to have the exact "Start" and "End" values for each partition. If these are off you could risk losing the data in the partition or that it may just not be available. Let me put the disclaimer out there that partitioning is a destructive process by it's very nature. Just re-partitioning it as you already have done *may* lose data (again it may not), and attempting to correct it *may* lose data (again it may not). Just saying there is no guarantee in anything dealing with re-partitioning. Provided the Knoppix LiveCD has fdisk available, and provided you have the exact partition table information from before the failure you should be able to boot off the CD and correct the partition table. Again while running under the LiveCD you should be able to attempt mounting the partitions *ONE-BY-ONE* in *READ-ONLY* mode without running fsck to see if the data is still there. The read-only mode and not running fsck is to make sure that nothing is attempted to be written to the drive. If this all succeeds then reboot again under the LiveCD and test the partition data again to make sure it passes a "reboot test" and is still available before attempting to boot it up under it's own power. You may need to have a LILO or GRUB boot-floppy available if the MBR was modified so as to make it non-bootable. There is a risk of data loss, which comes with dealing with re-partitioning but if you have accurate records of the prior partition table and proceeed methodically and logically you can limit those risks. I do not advice doing anything mentioned if you do not feel confident in any of the steps necessary or the information you have on the partition table. If you have an extra machine you could test with that you aren't worried with the data, you could attempt it on there before trying it on the machine in question. I would try it myself here if I had such a machine, but unfortunately the only way I could do so would be through VMware which might not be entirely accurate. Regards, Jeremy On Fri, May 13, 2005 at 01:32:01PM -0400, Deboo ^ wrote: > I accideantally fdisked my linux hard disk and deleted all > partitions, created one single solaris partition. I wanted to do this > on my second hard disk and thought I had connected the second one and > disconnected the first, but hadn't disconnected the first one really. > > Now I am unable to boot. Booting from a knpix CD, when I check what > partition is on that hard disk, I see only one partition, a bf type > partition (which means solaris) but is unformatted. Here's the output: > > [EMAIL PROTECTED] fdisk -l /dev/hda > > Disk /dev/hda: 40.0 GB, 40060403712 bytes > 16 heads, 63 sectors/track, 77622 cylinders > Units = cylinders of 1008 * 512 = 516096 bytes > >Device Boot Start End Blocks Id System > /dev/hda1 16253 3151480+ bf Unknown > > > Since it's not yet formatted, I would think there must be a way to > recover all the data still. I could install this knoppix on the small > 3 GB hdd and connecting the big hdd, try to recover. Is there a > program I can use to recover the data? Is it possible without using a > second 40 GB hard disk or it is not? > > I have lots of data on it, useful data and lots of linux things I > wouldn't like to lose. Can someone help? > > Thnks and Regards, > Deboo > -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Deboo ^ wrote: I accideantally fdisked my linux hard disk and deleted all partitions, created one single solaris partition. If you ever ran lilo on a root partition of the disk, then it probably saved a copy of the mbr in the /boot directory which can be manually restored with a disk editor (for example), although I'm not sure about the multiple disk scenario you describe, or about grub. Furthermore this will only work if you did not repartition the drive after running lilo, but even if you did, at least the root partition at that time should still be recoverable assuming you didn't do anything fancy in the meantime, like resize the root partition with parted. If all else fails, there are a number of ways to deduce and restore the correct partition table entries, either manually via inspection of the disk contents, or using various automatic recovery tools, or even by trial and error. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Deboo writes: > Well, what would have been written on to the disk other than the new > partition information and that is in the MBR. No formatting wsaa done. If all you did was repartition the disk you can fix it completely by partitioning it back exactly the way it was. Just get out your printed copy of the partition table and use fdisk. -- John Hasler -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Hello Deboo ^ (<[EMAIL PROTECTED]>) wrote: > I accideantally fdisked my linux hard disk and deleted all > partitions, created one single solaris partition. I wanted to do this > on my second hard disk and thought I had connected the second one and > disconnected the first, but hadn't disconnected the first one really. > [...] > Since it's not yet formatted, I would think there must be a way to > recover all the data still. > [...] Boot Knoppix from CD, and run gpart or testdisk. best regards Andreas Janssen -- Andreas Janssen <[EMAIL PROTECTED]> PGP-Key-ID: 0xDC801674 ICQ #17079270 Registered Linux User #267976 http://www.andreas-janssen.de/debian-tipps-sarge.html -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
Quoting Jason G Skala <[EMAIL PROTECTED]>: There is a great program out there called Stellar Phoenix http://www.stellarinfo.com/ It is not free however it does work and works well I have used it on my NTFS drives and linux drives even used it on a Tivo Drive. The program is a read only so you will need a working machine and enough drive space to copy data off the drive in question. Hope this helps you. Check out parted. If you remember approximately how big each partition was, then parted will be able to find it: http://www.gnu.org/software/parted/parted.html http://www.gnu.org/software/parted/manual/html_mono/parted.html#SEC24 -Roberto -- Roberto C. Sanchez http://familiasanchez.net/~sanchezr -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
There is a great program out there called Stellar Phoenix http://www.stellarinfo.com/ It is not free however it does work and works well I have used it on my NTFS drives and linux drives even used it on a Tivo Drive. The program is a read only so you will need a working machine and enough drive space to copy data off the drive in question. Hope this helps you. - Original Message - From: "Lee Braiden" <[EMAIL PROTECTED]> To: Sent: Friday, May 13, 2005 1:58 PM Subject: Re: Please help: Accidentally wiped off the whole hard disk!!! On Friday 13 May 2005 18:32, Deboo ^ wrote: Since it's not yet formatted, I would think there must be a way to recover all the data still. I could install this knoppix on the small 3 GB hdd and connecting the big hdd, try to recover. Is there a program I can use to recover the data? Yes, there is a program around for recovering partition tables. I just don't recall the name. But wait for someone to point you to it. In other words, don't get impatient and break stuff before you get a good answer ;) -- Lee. Please send replies to the list, not to my email address. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
On Friday 13 May 2005 18:32, Deboo ^ wrote: > Since it's not yet formatted, I would think there must be a way to > recover all the data still. I could install this knoppix on the small > 3 GB hdd and connecting the big hdd, try to recover. Is there a > program I can use to recover the data? Yes, there is a program around for recovering partition tables. I just don't recall the name. But wait for someone to point you to it. In other words, don't get impatient and break stuff before you get a good answer ;) -- Lee. Please send replies to the list, not to my email address. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
Re: Please help: Accidentally wiped off the whole hard disk!!!
On 5/13/05, Glenn English <[EMAIL PROTECTED]> wrote: > On Fri, 2005-05-13 at 13:32 -0400, Deboo ^ wrote: > > > Since it's not yet formatted, I would think there must be a way to > > recover all the data still. > > I think that's right. If you know *exactly* the way the disk was > partitioned before (and nothing has been written to it), you should be > able to run fdisk and put the old partition back. I think most probably I have the fdisk information written in to a text file kept in my email server's storage space, but what do you mean by "theoretically"? > If something's been written, it (probably) scribbled over something. But > the rest of the disk should be OK. Well, what would have been written on to the disk other than the new partition information and that is in the MBR. No formatting wsaa done. > > Is there a > > program I can use to recover the data? Is it possible without using a > > second 40 GB hard disk or it is not? I got small dos-based data recovery program from a friend but haven't ever used it. It needs to be put it on to a floppy and boot the system, then put a new hard disk and it recovers on to that disk. > The only thing I know of is to simply put the partition table back the > way it was. It's theoretically possible to dd the entire disk and get it > back, but you'd need that data rly badly to even think about that. > > Like I said, though, "The only thing I know of." > > -- > Glenn English > [EMAIL PROTECTED] > GPG ID: D0D7FF20 > > > BodyID:12580499.2.n.logpart (stored separately) > > Regards -- Please don't Cc: me, I'm subscribed to the list.
Re: Please help: Accidentally wiped off the whole hard disk!!!
On Fri, 2005-05-13 at 13:32 -0400, Deboo ^ wrote: > Since it's not yet formatted, I would think there must be a way to > recover all the data still. I think that's right. If you know *exactly* the way the disk was partitioned before (and nothing has been written to it), you should be able to run fdisk and put the old partition back. If something's been written, it (probably) scribbled over something. But the rest of the disk should be OK. > Is there a > program I can use to recover the data? Is it possible without using a > second 40 GB hard disk or it is not? The only thing I know of is to simply put the partition table back the way it was. It's theoretically possible to dd the entire disk and get it back, but you'd need that data rly badly to even think about that. Like I said, though, "The only thing I know of." -- Glenn English [EMAIL PROTECTED] GPG ID: D0D7FF20 signature.asc Description: This is a digitally signed message part
Please help: Accidentally wiped off the whole hard disk!!!
I accideantally fdisked my linux hard disk and deleted all partitions, created one single solaris partition. I wanted to do this on my second hard disk and thought I had connected the second one and disconnected the first, but hadn't disconnected the first one really. Now I am unable to boot. Booting from a knpix CD, when I check what partition is on that hard disk, I see only one partition, a bf type partition (which means solaris) but is unformatted. Here's the output: [EMAIL PROTECTED] fdisk -l /dev/hda Disk /dev/hda: 40.0 GB, 40060403712 bytes 16 heads, 63 sectors/track, 77622 cylinders Units = cylinders of 1008 * 512 = 516096 bytes Device Boot Start End Blocks Id System /dev/hda1 16253 3151480+ bf Unknown Since it's not yet formatted, I would think there must be a way to recover all the data still. I could install this knoppix on the small 3 GB hdd and connecting the big hdd, try to recover. Is there a program I can use to recover the data? Is it possible without using a second 40 GB hard disk or it is not? I have lots of data on it, useful data and lots of linux things I wouldn't like to lose. Can someone help? Thnks and Regards, Deboo -- Please don't Cc: me, I'm subscribed to the list.
