Ubuntu

Need help recovering data lost after mistaken reformat.

Asked by WestCoast

I am new to Ubuntu. I was setting up my system to dual boot Windows XP and Ubuntu. However, instead of Windows loading itself on the prepared c & d partitions of my 160 gig internal hard drive, it wiped out my 260 gig non-bootable USB External data disk (and all the data files on it), repartitioned the external drive (one 28 gig partition and one 204 gig partition), loaded Windows on the first partition (28gig), and a small program (20-40 meg) on the second (204 gig partition). I need those data files back, ASAP!

Windows has occupied about 2 gig of the 1st (28 gig partition), and about 20-40 meg of the second 204 gig partition. The files are there I have seen them. I tried a windows based demo which showed me my wpd, jpeg, gif, avi files. They are there. Unfortunately, I am in critical need of these files (especially the wpd files), but I simply can't afford the 500-1500 cost of the program!.

I am an 'old' MS Dos User from long ago so I am not too foreign to the command line, but I am 'very new' to the Ubuntu/Linux language. Does anyone know of a Ubuntu/Linux/Windows program that is not terribly complex ('new user stye) that will help me recover my data files. Critical files needed now are (Word Perfect) wpd files as well as jpg, gif, etc.

Thanks,
WestCoast

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
WestCoast (fayemore) said : 		#1

Aim Says it is disconnected and I don't know how to reconnect it. Please email me <email address hidden>

Revision history for this message
Harvey Muller (hlmuller) said : 		#2

WestCoast,

Good news:

   There are some good linux data recovery (forensics) tools that won't cost you a dime.

Bad news:

    Using them does cost you in terms of time to learn, and then time to use.

Recommendation:

1. Do not do anything with that 260G external usb drive, period, until you are ready to begin restoring what data you can. You don't want to accidentally destroy any more data.

2. Obtain a second drive of equal size or larger, to image the first drive. That way you will have a backup of what good data you have left, in its current state.

3. Read this for background information on the recovery process: http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-willis-c/bh-us-03-willis.pdf

    That is where I learned to recover data after I accidentally wiped out an external 20GB hard drive.

4. Autopsy and sleuthkit are discussed as tools in #3 above.

5. The 'file carving' tools you want to look at first however are:

    photorec, scalpel, and foremost

The file carving tools will do a pretty good job of recovering what is not damaged. They will also grab partially damaged files, which you will have to sift through also.

I'm not quite sure what your second message means, so cannot provide a response. The information above should get you back on the road to recovering your data.

Please let me know if this has resolved your question, or if you require additional information.\

Regards,

Harvey

Revision history for this message
WestCoast (fayemore) said : 		#3

Harvey Muller wrote:
> Your question #29100 on Ubuntu changed:
> https://answers.launchpad.net/ubuntu/+question/29100
>
> Status: Open => Answered
>
> Harvey Muller proposed the following answer:
> WestCoast,
>
> Good news:
>
> There are some good linux data recovery (forensics) tools that won't
> cost you a dime.
>
> Bad news:
>
> Using them does cost you in terms of time to learn, and then time to
> use.
>
> Recommendation:
>
> 1. Do not do anything with that 260G external usb drive, period, until
> you are ready to begin restoring what data you can. You don't want to
> accidentally destroy any more data.
>
> 2. Obtain a second drive of equal size or larger, to image the first
> drive. That way you will have a backup of what good data you have left,
> in its current state.
>
> 3. Read this for background information on the recovery process:
> http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-willis-c/bh-
> us-03-willis.pdf
>
> That is where I learned to recover data after I accidentally wiped
> out an external 20GB hard drive.
>
> 4. Autopsy and sleuthkit are discussed as tools in #3 above.
>
> 5. The 'file carving' tools you want to look at first however are:
>
> photorec, scalpel, and foremost
>
> The file carving tools will do a pretty good job of recovering what is
> not damaged. They will also grab partially damaged files, which you
> will have to sift through also.
>
> I'm not quite sure what your second message means, so cannot provide a
> response. The information above should get you back on the road to
> recovering your data.
>
> Please let me know if this has resolved your question, or if you require
> additional information.\
>
> Regards,
>
> Harvey
>

Harvey,

Thank you so much for responding to me so quickly. I agree with the
idea of getting a second drive to use until I can recover my files from
my damaged drive. It seems as though this learning curve will
definitely take some growth time that I am willing to give.

I'll review these sites you recommended. Thanks again for taking the
time to assist me.

WestCoast

Revision history for this message
Harvey Muller (hlmuller) said : 		#4

WestCoast,

I've found it's well worth investing the time, as you'll find it won't be the last time you ever need to recover data, either for yourself or someone else.

Please let me know if this resolves your question, or if you require more information.

Best regards,

Harvey

Revision history for this message
Harvey Muller (hlmuller) said : 		#5

WestCoast,

Just checking in. Please report back to Launchpad and let me know whether your question was solved, or if you require further information.

Thanks,

Harvey

Can you help with this problem?

Provide an answer of your own, or ask WestCoast for more information if necessary.

To post a message you must log in.