2

I am looking for a way to recover data off a perfectly good external HDD. Not a problem usual.

The drive was being used as a backup drive for computers that I was working on during a reformat. Several problems occurred during my instillation of windows drivers. So I decide the best action was to reformat the computer again with Linux to wipe the the windows install so that I could start again. During this process instead of wiping the computer hard drive it wiped and installed Ubuntu to the backup drive.

Dose any one have any tools that can help me retrieve the original data from the drive.

The drive was formated with and NT file system before I backed up the data and was reformatted to and ex3 file system after the Linux installation to the drive. If that makes any difference.

I know Win Image will allow me to image the drive and see what is on the drive but am unsure if it will let me carve for information or write information to the sectors to try and rebuild the original NT file system.

Eric Rich
  • 155
  • 4
  • 1
    You may want to check out some posts under the Data Recovery tag http://serverfault.com/questions/tagged/data-recovery – Kara Marfia Jul 01 '09 at 14:42

2 Answers2

5

If you actually completed the install of Ubuntu to the external drive then it stands a good chance that you've smashed the data. If all you did was write down a new partition table and possibly ran an mkfs then there might still be a goodly portion of the NTFS structure left.

I've done something like this (accidently did a DISKPART CLEAN to the wrong disk - the original disk was a single NTFS partition filling the entire volume), and here's what I did to recover:

  • Wrote a duplicate of the original partition table to the disk using Linux fdisk. Linux fdisk implementations only touch the MBR, so it didn't further damage the drive.
  • Wrote a new partition boot sector to the NTFS partition I created with Linux FDISK using the "ms-sys" utility (available pre-compiled in BG-Rescue Linux - http://www.giannone.eu/rescue/current/).
  • Mounted the disk up on a Windows machine with a USB adapter and used "WinImage" to scan the drive for the NTFS MFT. A quick and dirty search for the MFT is to search the first 4 bytes of each sector for the string "FILE".
  • Once I found the MFT, computed the relative cluster number and stored that into offset 0x40 of the partition boot record.
  • Found that Windows would then mount the drive as an NTFS filesystem. Immediately copied off all the data I wanted to another drive.

Odds are that you smashed the data, though. Sorry...

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
3

So, if I understood you correctly you formatted then wrote over top of your backup drive, right?

Unformatting a drive is one thing... but once you write over top of the old information recovering it becomes EXTREMELY difficult.

Depending on how much of the drive was overwritten, what parts, etc you're probably looking at needing to use some forensic recovery tools or having a professional look at it.

KPWINC
  • 11,394
  • 3
  • 37
  • 45