# Data recovery of Harddrive [GIVEN UP]

## R4miu5

Hi,

I got the WD Netcenter (Network Harddrive) and i accidentially deleted on of the nfs shares (including files and folders)

So, i removed the harddrive and connected it to my linux pc. BIOS flawlessly detects the HD but 

```
fdisk -l
```

says he was unable to detect any partition table.

strange, bcs the harddrive itself worked smoothly as i took it out of the nas device.

i tried to recover the table using gpart but

```
gpart /dev/hdc
```

says

```
Possible partition (ReiserFS Filesystem) size etc. 

Fatal error: dev(/dev/hdc): seek failure.
```

Well, i don't know any further. But it seems the files are still there

```
grep -b /shares/main/<deleted share> /dev/hdc
```

reports, the files were still there

could anyone please help me?

thx in advance.

before anyone complains, i DID use google to find the stuff like gpart, etc. And i also tried the board search for data recovery, but that doesn't solve my part table problem.Last edited by R4miu5 on Tue Nov 21, 2006 5:56 pm; edited 1 time in total

----------

## Keruskerfuerst

You can use testdisk to recover the partition table: http://www.libe.net/themen/geloeschte-Partition-wiederherstellen.php

----------

## NeddySeagoon

R4miu5,

Do you know how the drive was partitioned ?

If it was one big partiton, use fdisk to create a new partition covering the whole drive, then you will get your filesystem back.

======== edit ==============

Do not make any filesystem. You need the one that was there.

----------

## R4miu5

Well, i don't know the partition table. The Netcenter created it and I don't know how. I'll try testdisk. Thanks for the advice

*edit* Testdisk didn't find any partition either

----------

## bonbons

Is there any partition? Maybe /dev/<disk> has the filesystem directly on itself... like some USB pens

----------

## NeddySeagoon

bonbons,

If the drive has a MS-DOS type partition table, like x86 and amd64 arches do then the first partition starts at block 63.

Thats a given.

If the drive never had an MS-DOS partition table, for whatever reason, all bets are off.

Provided you can see the drive in /dev you can attempt to mount the first partition with the loop option.

```
mount -o loop,ro,offset=32256 -t <your_fs> /dev/sda /mnt/some/mountpoint
```

That really is the whole drive, not a partition too.

the offset I've quoted my be out by 512 too. The command is harmless as if no superblock is found, no action is taken.

If the filesystem is present. the -o ro stops any writes.

This command treats the whole drive as a sequence of bytes and tells mount to look for a filesystem 32265 bytes into the drive.

It works on MS-DOS partitioned drives to mount the first partition. When that works, the filesystem size gives the end of the first partition, so we can fish for the start of the next partition in the same way.

----------

## R4miu5

Alright, that seems logical. But some things are unclear to me.

 *Quote:*   

> mount -o loop,ro,offset=32256 -t <your_fs> /dev/sda /mnt/some/mountpoint

 

Well, i unfortunately don't know the filesystem. But I tried ext2 ext3 vfat ntfs and reiserfs with no succes.

 *Quote:*   

> the offset I've quoted my be out by 512 too.

 

512 blocks or 512 bytes? I tried offset=512 and offset=262144 with all the named filesystems but none succeeded. Isn't there a possibility to determine the filesystem by reading the first blocks of the device?

I also wrote to WD and asked which fs and partitioning they use. Maybe they can help me.

I thank you for your help so far though.

----------

## NeddySeagoon

R4miu5,

The offset is in bytes, I may have got it wrong by 512 bytes either way, thats one disc block.

You can try 

```
-t auto
```

however, you  *MUST* use -o ro too. That asks mount to try all the filesystems known to your kernel.

Its not much better then guessing. Guessing and getting it wrong with a read only mount is OK. Getting it wrong with a read write mount that actually works will trash the filesystem. I've not seen it go wrong, but read 

```
man mount
```

for the heath warning.

----------

## R4miu5

Alright, I got mail from WD

- The Filesystem ist reiser

- They couldn't tell me more about the partitioning (they didn't know, if there was just one partition)

- They told me to look for a tool to read the data "binary". But how could i recover the data then?

I intended to mount it and then follow that tutorial

http://antrix.net/journal/techtalk/reiserfs_data_recovery_howto.comments

to recover the lost data...

so far

----------

