I have two drives in an external USB RAID1 box. The kernel sees this a just one drive, all the RAIDness is done by the external hardware. While preparing another RAID1 array with gdisk and mdadm I wrote over the partition table in the external box so it now thinks it's part of a RAID1 array. Is there any hope of recovering at least some of the old data? All the data was in one partition, formatted EXT2.
I found findSuper and am running it now. It's found many superblocks, with dates from just after the partition overwrite to some several years old. I have not done any writes to either of the disks yet. I'm resigned to loosing all the files, but if there is a way forward I'd like to try.
Scheduled Maintenance: We are aware of an issue with Google, AOL, and Yahoo services as email providers which are blocking new registrations. We are trying to fix the issue and we have several internal and external support tickets in process to resolve the issue. Please see: viewtopic.php?t=158230
[Hardware] Partition table overwritten, can I recover?
- dilberts_left_nut
- Administrator
- Posts: 5347
- Joined: 2009-10-05 07:54
- Location: enzed
- Has thanked: 13 times
- Been thanked: 66 times
Re: [Hardware] Partition table overwritten, can I recover?
Testdisk is my recommended tool for partition recovery.
Hardware raid may complicate matters.
Hardware raid may complicate matters.
AdrianTM wrote:There's no hacker in my grandma...
- kent_dorfman766
- Posts: 540
- Joined: 2022-12-16 06:34
- Location: socialist states of america
- Has thanked: 59 times
- Been thanked: 70 times
Re: [Hardware] Partition table overwritten, can I recover?
If you know what sectors the partitions started and stopped on and you know their types then you can recover data from them, but it is rare that folks save that data offline for these types of emergencies.
-
- Posts: 7
- Joined: 2022-12-04 16:07
- Been thanked: 2 times
Re: [Hardware] Partition table overwritten, can I recover?
There is a chance that you can recover some of the old data using findSuper and a data recovery tool such as ext2undelete or ext3grep. These tools scan the file system for deleted files and inode information, which can be used to recover the files. However, it's important to note that the chances of recovery are not guaranteed and may vary depending on the amount of data that has been written to the drive since the partition table was overwritten.
It's also important to stop any further writes to the drive, as this can cause the data that you are trying to recover to become overwritten. If you are able to recover any files, it's best to save them to a different drive to avoid any further data loss.
It's also worth noting that you should be careful when using recovery tools as they can cause further damage to the drive, so you might want to consider using professional data recovery service.
It's also important to stop any further writes to the drive, as this can cause the data that you are trying to recover to become overwritten. If you are able to recover any files, it's best to save them to a different drive to avoid any further data loss.
It's also worth noting that you should be careful when using recovery tools as they can cause further damage to the drive, so you might want to consider using professional data recovery service.
Re: [Hardware] Partition table overwritten, can I recover?
Nothing has been written to the drives since the incident. I'm waiting for another 4T drive to arrive so I can image the damaged drive and work on the image. So far all I've done is put two new drives in the external NAS box and format them for RAID1. Next step is to remove them and see what (if any) changes the hardware NAS makes to the drive format.
This is a background project as most of the important data was backed up to the cloud. Not all though...
This is a background project as most of the important data was backed up to the cloud. Not all though...
-
- Posts: 7
- Joined: 2022-12-04 16:07
- Been thanked: 2 times
Re: [Hardware] Partition table overwritten, can I recover?
It's good to hear that some of the data was backed up, and that you have a plan for creating an image of the damaged drive. That way, you can work on the image and minimize the risk of further data loss
Before you image the drive, you should run a disk checking tool, such as "fsck" or "chkdsk", to check the integrity of the file system and repair any errors. Then, once the image is created, you can use data recovery tools on the image instead of the physical drive to minimize the risk of further data loss.
I hope I was helpful!
Before you image the drive, you should run a disk checking tool, such as "fsck" or "chkdsk", to check the integrity of the file system and repair any errors. Then, once the image is created, you can use data recovery tools on the image instead of the physical drive to minimize the risk of further data loss.
I hope I was helpful!