Linux recover faile

Question

I really did a big mistake. I have a partition sda6 for backup, when writing the iso to a pendrive, instead of typing sdb6, i've typed sda6, is there any way to get back the files

Yes. Restore from your backups. – Michael Hampton Oct 13 '15 at 13:31 — Michael Hampton, Oct 13 '15 at 13:31

score 2 · Answer 1 · answered Oct 13 '15 at 13:32

2

It's highly likely that your data is gone. Either restore from your backups or pay the money to send your drive to a data recovery firm and pray that they're able to salvage some of it.

answered Oct 13 '15 at 13:32

EEAA

108,414
18
172
242

score 1 · Answer 2 · answered Oct 13 '15 at 13:42

1

There are many ways of restoring files back from filesystems, especially in linux FS in these times (i.e. forensic analysis). Maybe you won't get 100% but surely you can recover most of it, in some case all of it if you are lucky and have not overwritten multiple times in same sector/blocks.

If your filesystem is not damaged, means if it can be mounted and only data is been deleted/overwrite then likely you can get your data. Otherwise if filesystem is corrupt it is likely you need to repair it first and then go for recovery (in this last case you might loose some data).

Anyway, you can choose the option between a dedicated linux distro for data recovery (see distrowatch.com) or using some tool like:

   http://extundelete.sourceforge.net/

This is the good of Free Open Source Software, you have solution almost for everything.

answered Oct 13 '15 at 13:42

ostendali

373
1
4

extundelete is unlikely to help in this scenario since the filesystem data structures and journal are probably destroyed. – Michael Hampton Oct 13 '15 at 13:43
allow me to disagree, I have recovered myself a filesystem where the data was written on using dd and the filesystem structure was damaged (not destroyed). :-) – ostendali Oct 13 '15 at 13:47
just to give a few hints here, first you need to boot from live cd as I suggested earlier, then after mounting the filesystem run: mkfs.ext4 -S /dev/sdaX this will fix the partition (if the partition is not damaged then you can skip this step) and it will drop all your data in lost+found where you can recover them using many ways of file recovery. Here you will find a good guide: https://help.ubuntu.com/community/DataRecovery#Imaging_a_damaged_device.2C_filesystem_or_drive or http://shearer.org/Ext4_recovery (unless you have not overwritten multiple times) – ostendali Oct 13 '15 at 13:59

score 0 · Answer 3 · answered Oct 13 '15 at 14:18

When you need to restore something, I prefer to work, on images of the device I want to recover from. I create the image of the disk or partition on a system that allows me to have snapshots, like LVM, btrfs or zfs. This allows me to do changes on the image and being able to revert to any snapshots I took.

Because you overwrite part of the volume with another stuff, you can confuse restore programs. It would be better to write with zeroes the the first part that was written with the ISO9660 image. After this you can use something like extundelete as @ostendali was mentioning or testdisk and photorec.

Linux recover faile

3 Answers3