[lug] Data recovery

[Gary Hodges]

On 03/23/2011 09:29 AM, Aaron Nichols wrote:
> On Wed, Mar 23, 2011 at 9:06 AM, Gary Hodges<Gary.Hodges at noaa.gov>  wrote:
>> I've done some searching, but most everything I've read assumes some
>> partitions to work with.  The files I am interested in retrieving are
>> all pictures, and all have IMG in the file name.  I'm looking for ideas
>> to try and retrieve those files.  They are all on the Ubuntu partition.
>>   I don't care about anything on the Windows partition.
>
> I've had some luck using a utility called 'testdisk'
> (http://www.cgsecurity.org/wiki/TestDisk) to recover partition tables.
> Assuming that's all that's damaged or missing it may help. Do use it
> on a copy of whatever data you are trying to fix because it will need
> to try to re-write the partition table. There are also probably some
> general data recovery utilities out there that don't assume a valid
> partition table exists - I'm just not sure what those might be.

Thanks for that suggestion.  It gives some tantalizing information, but 
ultimately it doesn't seem capable of fixing the partitions.  I now have 
hope that the files I want can be recovered.  The utility "knows" about 
the partition I want:
   EXT4 Large file Sparse superblock Recover, 46 GB / 43 GiB
but I'm ultimately left with a "partition can't be recovered" message.

Here are some lines from the logfile that was created
----------------------
search_part()
Disk mini9.img - 61 GB / 57 GiB - CHS 7494 255 63
      HPFS - NTFS              0   1  1  1567 254 63   25189857
      NTFS, 12 GB / 12 GiB
      Linux                 4199   1 27  9875 232 21   91199488
      EXT4 Large file Sparse superblock Recover, 46 GB / 43 GiB
This partition ends after the disk limits.
      Linux                 4202  16 39  9878 247 33   91199488
      EXT4 Large file Sparse superblock Recover, 46 GB / 43 GiB
This partition ends after the disk limits.
      Linux                 4207 171 61  9884 147 55   91199488
      EXT4 Large file Sparse superblock Recover, 46 GB / 43 GiB
This partition ends after the disk limits.
      Linux Swap            7245  16  4  7493  36 15    3985392
      SWAP2 version 1, 2040 MB / 1945 MiB
Disk mini9.img - 61 GB / 57 GiB - CHS 7494 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (61 GB / 57 GiB) seems too small! (< 81 GB / 75 GiB)
The following partitions can't be recovered:
      Linux                 4199   1 27  9875 232 21   91199488
      EXT4 Large file Sparse superblock Recover, 46 GB / 43 GiB
      Linux                 4202  16 39  9878 247 33   91199488
      EXT4 Large file Sparse superblock Recover, 46 GB / 43 GiB
      Linux                 4207 171 61  9884 147 55   91199488
      EXT4 Large file Sparse superblock Recover, 46 GB / 43 GiB