Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

A hard-drive with four partitions

  1. Ubuntu
  2. Swap
  3. Data
  4. Free

was accidentally formated and then partitioned in the same way with the same partition sizes again. I am looking for a way to retrieve a single file from the Data partition. It is a *.odt file with mainly text in a table in it.

So far I tried to use photorec and tried to find some keywords of that file with grep but without any success. Some files are reproduced but not the one I am looking for.

Is there a way to grep though the partition to look for some key words? Or are there other tools more suitable to retrieve the data?

share|improve this question
    
if it was repartitioned, you likely don't have the data anymore. –  Thomas W. Aug 14 '11 at 15:16

3 Answers 3

up vote 8 down vote accepted

Depending on the size and fragmentation of the lost file it could be possible to recover it, as when a partition is formatted, a tiny fraction of the available space is actually overwritten.

Use photorec and

  • choose the same partition the file was on
  • select File Opt and check to look for zip files (*.odt files are in fact zip files)
  • choose Whole to analyze all data, not just "unallocated" data

Then you will be presented with all zip files photorec has found. There is no way to grep the files directly as they are compressed, but you can use zipgrep as shown below. Or, as no filenames will be retrieved, you'll have to open each one and check.

To automate the search change directory to the retrieved files use zipgrep to find a word or a pattern, for example like this (it will show all files with the pattern pattern in them):

cd retrieved_files
for F in *; do zipgrep -q pattern "$F" && echo $F; done
share|improve this answer
    
That *.odt files are zip files was the clue. photorec actually recovered the *.odt file with the correct suffix. Man, you saved me a lot of money! If I could I'd rate you up a hundred times ;) –  Woltan Aug 14 '11 at 19:55
    
Thanks for reporting back too :) –  arrange Aug 14 '11 at 20:07
    
Yes, thank you for confirming the answer. Very useful to others as well. :) –  Jo-Erlend Schinstad Aug 14 '11 at 23:09

The guide to data recovery in Ubuntu's community documentation is an excellent resource. As it explains, you can attempt to recover partitions with parted, testdisk, or gpart. If that is not successful, you can use other methods to try to recovery individual files from the drive. These other methods are also explained in that guide.

Any changes to your partition table--including the creation of new partitions--are unlikely to overwrite the actual data in your files. So, assuming that is the only change that has been made, your files should be fully recoverable (perhaps with some effort).

share|improve this answer

Try using testdisk under ubuntu, this can both restore the partition table and recover lost files.

The command to use in terminal is : sudo apt-get install testdisk

share|improve this answer
1  
But not AFTER a new partition table has been created, which is the case here. He had a drive, it got reformatted. With all new partitions. Those new partitions made it nigh impossible for him to recover data. –  Thomas W. Aug 14 '11 at 15:33
    
@The Evil Phoenix That's strange I managed it last week although I hadn't done anything except the format before I realised what I'd done and had only done a quick format. –  Col Aug 14 '11 at 15:51
1  
Indeed, whether or not new partitions were created is pretty irrelevant to whether or not testdisk and similar methods can succeed. Testdisk looks at data throughout the disk to figure out what partitions were there; the original partition table does not itself have to be recoverable. In fact, it is often easier (and virtually always possible) to recover any amount of data after the creation of new partitions than to recover a single file deleted normally (which is sometimes impossible). –  Eliah Kagan Aug 14 '11 at 16:39
    
Once data has been written to said partitions that no longer exist, the data tables tend to not exist. As such, if he has reinstalled Ubuntu after losing that partition table as he did, the probability that he loses the data has risen to about 99%. –  Thomas W. Aug 14 '11 at 20:15
    
@ThomasWard Sorry for the delay in responding. Wiping out the partition table by overwriting it with a new partition table is not a huge problem. You don't even need to have any recoverable data from the part of the disk containing the partition table, to recover files with modern utilities like those described here. If you install an operating system on the newly created partitions, then that makes it much harder to recover data, because you've probably overwritten some or all of it. –  Eliah Kagan Nov 25 '11 at 3:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.