  | |  | disk recovery | disk recovery 2005-05-26 - By Magee, Fred (MRC)
Back Good afternoon. Due to various reasons we have a classified system with no backup mechanism and have a hard drive with critical user data that has become corrupted. Does anyone out there know of any software available that can go in and repair directories and other files? We have 1000's of hours of critical user data I need to recover and we cannot remove the disk from it's location so sending it to a data recovery company is not possible. When I do an ls -l on the old /home partition I see things like this: ?rwxr-xr-x 52 username1 username1 48621462 1657991535 15628596 May 26 15:56 username1/ ?rwxr-xr-x 52 username2 username2 48621462 1657991535 15628596 May 26 15:56 username2/ ?rwxr-xr-x 52 username3 username3 48621462 1657991535 15628596 May 26 15:56 username3/ drwxr-xr-x 3 username4 username4 4096 May 23 13:45 username4 The large numbers are different for each of the usernames but the basic structure looks to be similar. Is there a way to force an fsck against this partition to see if it can recover anything? We have done a dd if=/dev/sda of /dev/hdd bs= 32768 so I have an "exact" copy of the disk.
Thanks for any information anyone can provide.
<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas -microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office :smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=ProgId content=Word.Document> <meta name=Generator content="Microsoft Word 10"> <meta name=Originator content="Microsoft Word 10"> <link rel=File-List href="cid:filelist.xml@(protected)"> <o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="time"/> <!--[if gte mso 9]><xml> <o:OfficeDocumentSettings> <o:DoNotRelyOnCSS/> </o:OfficeDocumentSettings> </xml><![endif]--><!--[if gte mso 9]><xml> <w:WordDocument> <w:SpellingState>Clean</w:SpellingState> <w:GrammarState>Clean</w:GrammarState> <w:DocumentKind>DocumentEmail</w:DocumentKind> <w:EnvelopeVis/> <w:Compatibility> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> </w:WordDocument> </xml><![endif]--><!--[if !mso]> <style> st1\:*{behavior:url(#default#ieooui) } </style> <![endif]--> <style> <!-- /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-parent:""; margin:0in; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman";} a:link, span.MsoHyperlink {color:blue; text-decoration:underline; text-underline:single;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline; text-underline:single;} span.EmailStyle17 {mso-style-type:personal-compose; mso-style-noshow:yes; mso-ansi-font-size:10.0pt; mso-bidi-font-size:10.0pt; font-family:Arial; mso-ascii-font-family:Arial; mso-hansi-font-family:Arial; mso-bidi-font-family:Arial; color:windowtext;} span.SpellE {mso-style-name:""; mso-spl-e:yes;} span.GramE {mso-style-name:""; mso-gram-e:yes;} @(protected) Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in; mso-header-margin:.5in; mso-footer-margin:.5in; mso-paper-source:0;} div.Section1 {page:Section1;} --> </style> <!--[if gte mso 10]> <style> /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman";} </style> <![endif]--> </head>
<body lang=EN-US link=blue vlink=purple style='tab-interval:.5in'>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'>Good afternoon.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'>Due to various reasons we have a classified system with no backup mechanism and have a hard drive with critical user data that has become corrupted.<span style='mso-spacerun:yes'> </span>Does anyone out there know of any software available that can go in and repair directories and other files?<span style='mso-spacerun:yes'> </span>We have 1000’s of hours of critical user data I need to recover and we cannot remove the disk from it’s location so sending it to a data recovery company is not possible.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'>When I do an <span class=SpellE>ls</span> –l on the old /home partition I see things like this:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><span style='mso-tab-count:1'> </span>?<span class=SpellE>rwxr-xr-x</span> <span style='mso-spacerun:yes'> </span>52 username1 <span style='mso-spacerun:yes'> </span><span style='mso-spacerun:yes'> </span><span class=SpellE>username1</span> 48621462 1657991535 15628596 May 26 </span></font><st1:time Hour="15" Minute="56"><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>15:56</span ></font></st1:time><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> username1/ <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><span style='mso-tab-count:1'> </span>?<span class=SpellE>rwxr-xr-x</span> <span style='mso-spacerun:yes'> </span>52 username2 <span style='mso-spacerun:yes'> </span><span style='mso-spacerun:yes'> </span><span class=SpellE>username2</span> 48621462 1657991535 15628596 May 26 </span></font><st1:time Hour="15" Minute="56"><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>15:56</span ></font></st1:time><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> username2/ <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><span style='mso-tab-count:1'> </span>?<span class=SpellE>rwxr-xr-x</span> <span style='mso-spacerun:yes'> </span>52 username3 <span style='mso-spacerun:yes'> </span><span style='mso-spacerun:yes'> </span><span class=SpellE>username3</span> 48621462 1657991535 15628596 May 26 </span></font><st1:time Hour="15" Minute="56"><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>15:56</span ></font></st1:time><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> username3/ <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><span style='mso-tab-count:1'> </span><span class=SpellE><span class=GramE>drwxr-xr-x</span></span><span style='mso-spacerun:yes'> </span>3 username4<span style='mso-spacerun:yes'> </span><span class=SpellE>username4</span> 4096 May 23 </span></font><st1:time Hour="13" Minute="45"><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>13:45</span></font ></st1:time><font size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> username4<o :p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'>The large numbers are different for each of the usernames but the basic structure looks to be similar.<span style='mso-spacerun:yes'> </span>Is there a way to force an <span class=SpellE>fsck</span> against this partition to see if it can recover anything?<span style='mso-spacerun:yes'> </span>We have done a <span class=SpellE>dd</span> if=/dev/<span class=SpellE>sda</span> of /dev/<span class=SpellE>hdd</span> <span class=SpellE><span class=GramE>bs</span></span>= 32768 so I have an “exact” copy of the disk.<span style='mso-spacerun:yes'> </span><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'>Thanks for any information anyone can provide. <o:p></o:p>< /span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt; font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>
|
|
|