From ext3-users  Sun Feb 06 17:23:57 2011
From: Florian Weber <Florian.Weber () pfaffenhofen ! de>
Date: Sun, 06 Feb 2011 17:23:57 +0000
To: ext3-users
Subject: [solved] Overwritten beginning of ext3 filesystem. Recovery?
Message-Id: <201102061824.02169.Florian.Weber () pfaffenhofen ! de>
X-MARC-Message: https://marc.info/?l=ext3-users&m=129701332104799

Hello list

For the benefit of those searching the archives, here's how I got out of the 
mess described in my first mail on27dec2010.

0a. Be extra careful and use your brain before even touching the keyboard. Go 
to extreme measures to prevent typos.
0b. Keep backups: make a dd copy of your disk/partition and put the original 
hardware into a safe. Do not work on the master image. Make it read-only, 
create _another_ working copy and use _that_ for recovery. You will make 
mistakes and you do not want to touch the hardware.
0c. Be prepared to learn a lot of things about filesystems you never wanted to 
know.
0c. Whatevery you do, check the units your tools are using. Each time. They 
might be filesystem blocks, disk blocks, inodes, bytes, kB, kiB, ....
0d. Have a look at the thread "recovery recommendations" started by "m.p." on 
21jan2011

1. I overwrote the stuff I definitely knew to be faulty with zeroes, i.e. the 
first 10GB. I erred on the safe side, rather keeping bogus stuff than deleting 
good data.
2. This action killed my partition table. I had to restore it manually but was 
prepared for that.
3. I ran e2fsck on the broken partition. After the first run, it prompted me to 
be run again, which I did.
4. The filesystem now contained lost+found/ as it's only toplevel directory. 
Below that were many files and directories
5. I sorted those files/dirs and gave them meaningful names instead of block 
numbers. About 70% were recognizable from their content, among it *all* my 
personal data! The rest was unrecognizable binary and ASCII fragments which I 
discarded, there's a high likelyhood that most of it was actually deleted in 
the old filesystem, and it couldn't be restored anyway.
6. I compared against very old backups which showed no data loss.
7. I'm still doing lots of random samples to check for damaged files and loss 
of newer files, but found none so far.

Conclusions:
I got all my data back, but that was pure luck.
To account not only for  hardware but also for software and human failures, I 
have bought a USB harddisk which I use for weekly backups. I'm still 
evaluating which backup tools best fit my needs.

Hope this helps someone.

With best regards,
Florian Weber

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users