# data recovery - very urgent

## -leliel-

Hi,

my friend gave me a harddrive with a damaged partition table. Well, I've recovered it with fdisk and it tells me, there are two partitions (1, ntfs :: 2, fat32 ext') on this drive. But cfdisk tells me, the second partition is free space.  :Sad: 

I moved the drive into a win32 machine and it also says partition 2 is empty.  :Sad: 

fdisk output:

 *Quote:*   

> Disk /dev/hdb: 20.4 GB, 20485785600 bytes
> 
> 255 heads, 63 sectors/track, 2490 cylinders
> 
> Units = cylinders of 16065 * 512 = 8225280 bytes
> ...

 

Is there a way to recover the data located on partition two?

thanks

----------

## NeddySeagoon

-leliel-,

You have only recovered part of the partition table - the part in the Master Boot Record.

Partition 2 is an extended partition, in which you define further logical partitions.

Do you know the approximate partitioning of the logicval partitions?

Could make an image of the partition (or whole drive) with dd, mount the image with the mount -o loop command, then search for anything valuble.

Regards, 

NeddySeagoon

----------

## Moled

dd if=/dev/hda2 of=/somefile

now you have a copy of the data

mount -o loop =t vfat somefile /some/mountpoint

and you should be able to get at it

im not sure if that would work tho tis just a guess

----------

## klac

A Win32 Ext partition is empty space.  It's the placeholder for virtual partitions (hda5+ in Linux).

If you know the filesystem type and the boundaries of the filesystem from before (first cylinder & length), you may be able to recover the filesystem.  Other than that, you may be able to get some data through some hard work & lots of spare time accessing the block device directly.

----------

## -leliel-

thank you very much for the answers.

But there's an error while mounting:

 *Quote:*   

> mount: could not find any device /dev/loop#

 

loop device support is compiled in the kernel (block devices->loopback) ... but there's really no /dev/loop device. Kernel is hardened-2420.

----------

## klac

Try the following:

```

# Create a loop device.  May or may not work with devfs

mknod /dev/loop0 b 7 0

# If the above fails, change to the following:

mknod /root/loop b 7 0

# And change other commands as appropriate

losetup -o 0 /dev/loop0 /tmp/image_file

mount /dev/loop0 /mnt

# Work with the image

umount /mnt

losetup -d /dev/loop0

```

In the first losetup command, the "-o" flag indicates an offset; keep incrementing the number following it (currently a zero) until you go past the end of the file (sorry, nothing to recover   :Sad:   ), or until you find a recoverable image   :Very Happy: 

Good luck

----------

## -leliel-

 *Quote:*   

> root@dozer / # dd if=/dev/hdb2 of=/tmp/image
> 
> 2+0 records in
> 
> 2+0 records out
> ...

 

damnit.  :Sad: 

Fat32 support is compiled in, too. Tried with some other win32 discs and all works fine.

 *Quote:*   

> If you know the filesystem type and the boundaries of the filesystem from before (first cylinder & length), you may be able to recover the filesystem. Other than that, you may be able to get some data through some hard work & lots of spare time accessing the block device directly.

 

How do I access the block device directly? It's very important data on this partition ...  :Sad: 

----------

## klac

To access the hard drive directly, use either /dev/hdb (entire drive) or /dev/hdb2 (partition) as it it were a file.  Use a binary editor to read the drive; or, if the data is more-or-less pure text, try using strings:

```
strings /dev/hdb | less
```

If you know what you're looking for (sample text from the document), you may be able to search the output for it.  Be aware, however, that the data may be fragmented around the drive. 

Apart from that, you may need to talk to the experts (a data recovery corp; be prepared to empty your savings account).

----------

## ruben

If there is something wrong with the partition table (are you sure there were only 2 partitions ?  do the sizes you have with fdisk mathc the sizes of the original partitions ?), then you may want to try GPart.

I have to admit i've never used it, but i accidentally 'encountered' it yesterday. I tries to find your original partition table. It's in portage.

----------

## ruben

Upon reading your post again.... the problem is probably that you have 1 primary partition, the NTFS one, the other is an extended partition...

Technically, a partition table is on the harddisk a table, always with *4* entries... primary partitions are stored with begin/end/blabla in the partition table. An extended partition however, will also have a begin/end/blabla, but will also provide a 'pointer' to another partition table. In that partition table, the first entry will indicate the first *logical* partition, the second entry will be a link to another partition table. In that one the first entry is the second logical partition, the second entry points to another partition table and so on.

So, right now, your only have restored the 'root' partition table, but your /dev/hdb2 is the extended partition, it's the container for your logical partitions... so you would have to find/define the logical partitions in that.

(i *hope* gpart can help you with that) You might be able to do that manually with a disk editor (which can help you a bit), but it's not gonna be easy....  I do know that a friend of mine actually recovered his data that way, but it cost him hours...

----------

## -leliel-

I got the data using a windows tool (schame on me) what was able to read out raw data files.

----------

## FuzzeX

For those wondering if gpart works I have a story:

I work in a computer lab at the University where I goto school and we were recently creating a new image to push to all of our lab computers (for the curious we duel boot w2k and gentoo linux). Well in the process of trying get our imaging software to work properly we started messing with the mbr and managed to issue the command:

```
dd if=/dev/zero of=/dev/hda bs=512 count=1

```

Brilliantly reducing our mbr to nothing, including our partition table.

So, as it happens we popped in the knoppix cd we have laying around and ran gpart. Amazingly it manage to recover all of our partitions, primary and extended. I'm amazed every time that machine boots. Hope it helps.

----------

