r-linux

A forum on data recovery using the professional data recovery software R-STUDIO.
stevem
Posts: 2
Joined: Fri Jul 03, 2009 4:46 am

r-linux

Post by stevem » Fri Jul 03, 2009 5:10 am

We have a ext3 disk (160GBytes) which was accidently repartitioned to 128GBytes and formatted to fat32 and used for a day with about 2GBytes written to it.
I download r-linux to see if we could recover data which had not been overwritten.
If I do the following:-
Reset the partition to 160GBytes using fdisk.
Use fsck to restore a valid superblock from one of the uncorrupted alternatives but not allow fsck to "fix" anything else.
Scan disk with r-linux
Select recover all file

We get back about half of our data which consists of a number of directories, each with 3 text file and a folder with many jpg files.
The other data on the disk is similar, consisting of directories with 1 text file and a folder with many ras files (sun raster files).
Can you think of any reason we get one type of data back rather than the other?

Clearly the early part of the disk was overwritten which means the inodes metadata (and the data!) for the initial disk groups has been lost. However r-linux has successfully located inodes for the directory fragments remaining in the uncorrupted disk groups for the jpg data. What could be causing the ras directory stubs to be missed?

If I don't repartition the disk back to 160GBytes and restore the superblock, r-linux works quite differently and does no restore any linux directory fragments. The presents of the valid fat32 data seems to make it operate quite differently.

R-linux has easily the best of any of the software in the ext2/3 disk recovery area we have tried!

Any comments you have would be much appreciated.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: r-linux

Post by Alt » Fri Jul 03, 2009 5:43 am

Frankly speaking, it's hard to say anything without looking at the data on the disk.
When you scanned the disk with the new FAT32, which were the parameters and color of the Linux partition you used to recover data?

stevem
Posts: 2
Joined: Fri Jul 03, 2009 4:46 am

Re: r-linux

Post by stevem » Fri Jul 03, 2009 8:47 am

the ext3 section was in red from memory. I dont have the disk with me currently.

What is of more interest to me is why the directory fragments with jpg files were found OK, but the directory fragments with the sun raster files were not. When directory fragments are being found, are file type signatures being used is someway? Perhaps our ras files are not matching r-linux's ras file definition. Our ras files do not include a colour look up table for example.

Alt
Site Moderator
Posts: 3129
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: r-linux

Post by Alt » Fri Jul 03, 2009 12:52 pm

If it was red, R-Studio found very few of the partition data.
By the way, it is a good idea to specify the ras file signature and perform scan with search for the known files. You may find the information on how to add a new file signature in the R-Linux help.

Post Reply