Well, if you can't find a utility to do it for you, I suppose you could
start seeking through the disk yourself with 'dd' or something. If you've
already thought of this, cool. If not, maybe I'm nuts, but standard Linux
utils should be able to get you most (if not all) of the way to getting
(some?) data back. NTFS filesystems should begin with something like:
(0xEB)(0x5B)(0x90)NTFS ...etc...
I'm still trying to figure out if there's a telltale "end of filesystem"
signature you could look for. In any case, if you can establish the start
and end blocks, you could use 'dd' to copy the data to a file:
dd if=/dev/hdX of=recover.ntfs bs=[blocksize] count=[blockcount]
then mount that file read-only:
mkdir /mnt/recover
mount -t ntfs -o loop,ro recover.ntfs /mnt/recover
and copy the data off. Note that this will effectively clone bad blocks,
so you may have to coerce 'mount' into cooperating by adding a '-s'. Even
then, it may refuse if the filesystem is too hosed.
Sorry I don't have time to expand on this more right now. If this method
sounds attractive, let me know, and I'll look into it after work.
Cheers,
-sth
sam hooker|[EMAIL PROTECTED]|http://www.noiseplant.com|(802)324-0500
On Wed, 15 Feb 2006, David wrote:
O.K. I will try to answer all of the above questions. I have not reformated
the drive. There was three partitions on the disk. I have tried putting it
back to the way that is before and that did not work. I have used fdisk and
it will error out but for some strange reason qt parted worked once to
rewrite the partition and know it will not write a new table to the
harddrive. The disk is shown on a linux bootdisk and from inside a windows
machine. Linux says that there are bad superblocks on the drive and windows
says that the drive is raw. I don't know exact file names I know what
directories that I am looking for if that helps at all I don't know. I have
never recovered from a major crash like this before on windows. Go figure I
back up all of my *Unix based machines but not the windows computer. How
ironic is that.
On 2/15/06, Chris Adams <[EMAIL PROTECTED]> wrote:
You can use several tools in linux to extract the data if you know what
you are looking for... something like foremost (a forensic analysis tool)
and possibly the sleuthkit and Autopsy might be able to help for free. Do
you remember excatly how the partition table was laid out before? Have you
formatted it since the table was lost? If you remember the partition table
layout and you have not formatted the drive it could be as simple as using
fdisk in linux to re-create the partitions and then mounting the disk (I
have seen this done several times with fat32 drives, never tried it with an
NTFS partition). If the latter does not work and you know exactly what you
are looking for your best bet may be a commercial tool (I think symantec
makes one) or the earlier mentioned foremost.
Chris
On 2/15/06, David <[EMAIL PROTECTED]> wrote:
I hate to start another message on this but I have a 60 gig harddrive
and the partition table is lost. I need the data off from it. I don't know
what to do the drive is formated in the ntfs file system with no encryption.
I tried using qtparted to write a new partition table but it didn't work. I
don't know what eles to do.
--
It's a good thing Linux is under GPL (General Public Lisense) or
Microsoft would buy opensouce projects out too!
---
Hac-Dan
--
Chris
www.chrisadams.org
www.linuxchris.com
AOL and Yahoo IM - fan0of0as
MSN Messenger - [EMAIL PROTECTED]
--
It's a good thing Linux is under GPL (General Public Lisense) or Microsoft
would buy opensouce projects out too!
---
Hac-Dan
