[ILUG] Data recovery

[Paul O'Malley]

Conor Wynne wrote:

>
> On 9 Dec 2005, at 22:38, Niall O Broin wrote:
>
>> On 9 Dec 2005, at 22:28, Michael Treacy wrote:
>>
>>> I backed up my data on my laptop about 3 weeks ago, upgraded SuSE  
>>> 9.3 to SuSE 10.0 OSS and wasn't too happy with the result.
>>>
>>> So last night, I installed the full version of SuSE 10.0 choosing  
>>> to set the installation as a new one rather than an upgrade.
>>>
>>> When I went to copy my backed up /home diurectory back on, I  
>>> discovered to my horror that the backup had not been  succesfull!!!! 
>>> The CD was blank :(
>>>
>>> So, is there any chance that the files may still be on the  
>>> laptop???? I'm not sure if the drive was formatted as part of the  
>>> new installation or not.
>>
>
> Maybe anaconda will have recorded it? check.
>
>>
>> Only you can answer that. When you did the new install, SuSE will  
>> have found the old partitions, and will have asked you what to do  
>> with them. What did you decide? Is your disk now one big /  partition 
>> (maybe with a small /boot) ?  Was your /home originally a  separate 
>> partition, or just a directory on the / partition? (This  illustrates 
>> why the "one big /" idea for a single user workstation,  with local 
>> /home, is not the best idea)
>
>
> Try :
> fdisk -l
> determine what partitions you have.
>
> Then
> e2label /dev/xxx
>
> Anything not mounted?
> cool, mount it.
>
> All used?
> Oh dear.
>
Well ehh I may not agree with Conor on this one!

Trying the coroners tool kit may be of use to you.
It is to be found here:
http://www.porcupine.org/forensics/tct.html#features

Then you may wish to specificially look at this:
http://www.fish2.com/tct/help-recovering-file

However I do wish you luck, it is going to be tough.

Regards,

Paul O'Malley