Before I begin to say what my situation is here, please know i would be FOREVER GRATEFUL for anyone who can help me out with this mess. I have photos on here from years and years of painstaking work. I am a semi-pro photographer and my hard disk contains roughly 1.5 TB of data from photos. Plus 100GB of my entire music library, and all my dvd's I took time to tip on to my hard disk. But my photos are what I'm most concerned about, they are not replaceable.
Now here in short is what happened: I have always had a backup of my data using backblaze, which is an online backup for windows. I decided about 3 months ago I wanted to get a server going for my files using plex and decided unbuntu was the best way to go. So I was utilizing this backup method using something called "greyhole" and in the process of setting up (2) 2TB hard drives and (1) 1 TB harddrive on this greyhole backup program.
Then that is when I got a rootkit. This thing was nasty and I think after 2 months of trying everything, I had to reflash my bios and STILL had this virus. I had to reformat all my hard drives and backed everything up on to 1 hard drive filling it almost entirely (a 2 TB hard drive). I still did not get rid of this virus it was incredible. Eventually I caught it. It was embedded in my network ethernet card. Anyone reading this should take heed that anything embedded in there can and will infect your router, all your LAN, and stay on your computer even through reflashing of the bios itself!
Anyhow after I seemed to get rid of the thing I still had my files on my hard drive. I didn't want to reinfect my machines, so I tried to re-write the MBR using a utility called testdisk.
I didn't have a clue what I was doing. And now I can't read my information!
Here is the good news? After testdisk did it's thing (which consisted of me analysizing the drive, and using the WRITE command to do the damage, it only took 1 second for it to be done. Meaning - I didn't sit through a 5 hour process of writing 0's on the drive with "dd". It was a quick little thing I did. So for that reason I'm thinking the data still has to be on the drive.
Here is what I know:
- the drive is a data drive, no OS. I used ubuntu as the OS on another drive.
- formatted as ext3 or ext4
- size = 2 TB
- files = irreplaceable, my entire lifes work - no exageration.
Also - backblaze doesn't have my files anymore because it's been over 30 days. I have written over all my othre backups with 0's due to the rootkit. This hard drive was and is the only source of my files at the time when this happened. Coincidently this is the only time I've been without a backup for many years.
Here is a copy/paste of fdisk -l
Disk /dev/sda: 2000.4 GB, 2000398934016 bytes 255 heads, 63 sectors/track, 243201 cylinders, total 3907029168 sectors Units = sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disk identifier: 0x0006a14b Device Boot Start End Blocks Id System /dev/sda1 * 63 3907024064 1953512001 83 Linux Partition 1 does not start on physical sector boundary.
*-scsi:0 physical id: 2 logical name: scsi2 capabilities: emulated *-cdrom description: DVD writer physical id: 0.0.0 bus info: scsi@2:0.0.0 logical name: /dev/cdrom logical name: /dev/sr0 capabilities: audio cd-r cd-rw dvd dvd-r configuration: signature=643a3365 status=ready *-disk description: ATA Disk product: ST2000DM001-1CH1 vendor: Seagate physical id: 0.1.0 bus info: scsi@2:0.1.0 logical name: /dev/sda version: CC24 serial: W1E2L5K7 size: 1863GiB (2TB) capabilities: partitioned partitioned:dos configuration: ansiversion=5 sectorsize=4096 signature=0006a14b *-volume description: EXT3 volume vendor: Linux physical id: 1 bus info: scsi@2:0.1.0,1 logical name: /dev/sda1 version: 1.0 serial: 05ea2f85-06fd-446c-a885-30614d53630c size: 1863GiB capacity: 1863GiB capabilities: primary bootable journaled extended_attributes large_files recover ext3 ext2 initialized configuration: created=2013-03-27 07:57:02 filesystem=ext3 label=fuck modified=2013-03-27 08:11:50 mounted=2013-03-27 08:11:50 state=clean
Please help what can I do? I'm scared of screwing it up again with testdisk. I just want to recover the files. I can't see how they are gone.
Thank you so much-