5

A hard-drive with four partitions

  1. Ubuntu
  2. Swap
  3. Data
  4. Free

was accidentally formated and then partitioned in the same way with the same partition sizes again. I am looking for a way to retrieve a single file from the Data partition. It is a *.odt file with mainly text in a table in it.

So far I tried to use photorec and tried to find some keywords of that file with grep but without any success. Some files are reproduced but not the one I am looking for.

Is there a way to grep though the partition to look for some key words? Or are there other tools more suitable to retrieve the data?

1
  • if it was repartitioned, you likely don't have the data anymore.
    – Thomas Ward
    Aug 14, 2011 at 15:16

3 Answers 3

9

Depending on the size and fragmentation of the lost file it could be possible to recover it, as when a partition is formatted, a tiny fraction of the available space is actually overwritten.

Use photorec and

  • choose the same partition the file was on
  • select File Opt and check to look for zip files (*.odt files are in fact zip files)
  • choose Whole to analyze all data, not just "unallocated" data

Then you will be presented with all zip files photorec has found. There is no way to grep the files directly as they are compressed, but you can use zipgrep as shown below. Or, as no filenames will be retrieved, you'll have to open each one and check.

To automate the search change directory to the retrieved files use zipgrep to find a word or a pattern, for example like this (it will show all files with the pattern pattern in them):

cd retrieved_files
for F in *; do zipgrep -q pattern "$F" && echo $F; done
2
  • That *.odt files are zip files was the clue. photorec actually recovered the *.odt file with the correct suffix. Man, you saved me a lot of money! If I could I'd rate you up a hundred times ;)
    – Woltan
    Aug 14, 2011 at 19:55
  • Yes, thank you for confirming the answer. Very useful to others as well. :) Aug 14, 2011 at 23:09
3

The guide to data recovery in Ubuntu's community documentation is an excellent resource. As it explains, you can attempt to recover partitions with parted, testdisk, or gpart. If that is not successful, you can use other methods to try to recovery individual files from the drive. These other methods are also explained in that guide.

Any changes to your partition table--including the creation of new partitions--are unlikely to overwrite the actual data in your files. So, assuming that is the only change that has been made, your files should be fully recoverable (perhaps with some effort).

2

Try using testdisk under ubuntu, this can both restore the partition table and recover lost files.

The command to use in terminal is : sudo apt-get install testdisk

5
  • 1
    But not AFTER a new partition table has been created, which is the case here. He had a drive, it got reformatted. With all new partitions. Those new partitions made it nigh impossible for him to recover data.
    – Thomas Ward
    Aug 14, 2011 at 15:33
  • @The Evil Phoenix That's strange I managed it last week although I hadn't done anything except the format before I realised what I'd done and had only done a quick format.
    – Col
    Aug 14, 2011 at 15:51
  • 1
    Indeed, whether or not new partitions were created is pretty irrelevant to whether or not testdisk and similar methods can succeed. Testdisk looks at data throughout the disk to figure out what partitions were there; the original partition table does not itself have to be recoverable. In fact, it is often easier (and virtually always possible) to recover any amount of data after the creation of new partitions than to recover a single file deleted normally (which is sometimes impossible). Aug 14, 2011 at 16:39
  • Once data has been written to said partitions that no longer exist, the data tables tend to not exist. As such, if he has reinstalled Ubuntu after losing that partition table as he did, the probability that he loses the data has risen to about 99%.
    – Thomas Ward
    Aug 14, 2011 at 20:15
  • @ThomasWard Sorry for the delay in responding. Wiping out the partition table by overwriting it with a new partition table is not a huge problem. You don't even need to have any recoverable data from the part of the disk containing the partition table, to recover files with modern utilities like those described here. If you install an operating system on the newly created partitions, then that makes it much harder to recover data, because you've probably overwritten some or all of it. Nov 25, 2011 at 3:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .