From owner-freebsd-questions@FreeBSD.ORG Fri Jun 28 16:09:13 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 0F2F4A4B for ; Fri, 28 Jun 2013 16:09:13 +0000 (UTC) (envelope-from kkchn.in@gmail.com) Received: from mail-ie0-x236.google.com (mail-ie0-x236.google.com [IPv6:2607:f8b0:4001:c03::236]) by mx1.freebsd.org (Postfix) with ESMTP id D8E6516C4 for ; Fri, 28 Jun 2013 16:09:12 +0000 (UTC) Received: by mail-ie0-f182.google.com with SMTP id s9so4599526iec.13 for ; Fri, 28 Jun 2013 09:09:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=1DnPWlXIvL1vJs9CzUbO3Nnn3QpusfyYc8lvYjctcgo=; b=dK21Gd0uHy/UqJ+1Hu5xa0gGmEGCs5p3t7/rGcFSSmMBTSs0NRGRdfAm/97KE9oGK0 pZUQ2bwTrQU3ioLXh7sS8K2eMCPxCKfZnOn/yZGKWYCsKFUzz0mi/yEGwj+PAdNl4i7m aUFu28VSffnZk2rAXPy9+VrS4cg0KIZTWEZfbFVSPgwoGZo7vLXukGzYj/h6g0/6h1km lLTB2RHmmYaQLmVkBqIzbwVFdTrcH/tXf22ikTrCIkptVRcR5wQ8h/g+4NHACDPVpWml Q37AMBpV9ne26LEpRV3JBGCswMo2KeaK3guPw9IZCa2wAm/c+UD8omTcXcvGlcr1A2uh GoIw== MIME-Version: 1.0 X-Received: by 10.50.65.99 with SMTP id w3mr4505184igs.37.1372435752595; Fri, 28 Jun 2013 09:09:12 -0700 (PDT) Received: by 10.64.60.102 with HTTP; Fri, 28 Jun 2013 09:09:12 -0700 (PDT) In-Reply-To: <20130627094717.a3bab5aa.freebsd@edvax.de> References: <20130627094717.a3bab5aa.freebsd@edvax.de> Date: Fri, 28 Jun 2013 21:39:12 +0530 Message-ID: Subject: Re: Retrieving a FreeBSD installation From: KK CHN To: Polytropon Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.14 Cc: freebsd-questions X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2013 16:09:13 -0000 On Thu, Jun 27, 2013 at 1:17 PM, Polytropon wrote: > On Thu, 27 Jun 2013 07:28:49 +0000, KK CHN wrote: > > List, > > > > I accidentally installed a Linux variant(mint OS) on my Harddisk > > where FreeBSD is installed( which contains my data). > > > > Is there a possibility to retrieve that FreeBSD Installation which > > is overwritten by Linux installation. > > In most cases: What has been overwritten is lost. > > But: What has "only" been disallocated (data still on disk) > can _sometimes_ be recovered. > > So it depends on _what_ is still left. > > Anyway, do not do anything with the disk. Do not try any > recovery on the disk itself. Make an image of the disk and > use that image file for any further action. In case you > damage it, make a new copy. Only work with copies. One wrong > step can massively decrease your chances of recovery. > > > > > Any hints welcome! > > It will be a very hard thing. You will probably have a lot > of "trial & error" experience, and you will surely learn a > lot, for example about file systems. > > I've written about this topic on this list already, and I > will again re-use some details from a previous post to make > a list for what you can try. > > Boot from a live CD or USB stick or a different disk. Then > make a copy of the disk using > > # dd if=/dev/ad0 of=disk.dd > > where /dev/ad0 is the disk you have accidentally overwritten > your OS installation. In case the disk makes any trouble, use > dd_rescue or ddrescue (from ports). > > You can also try this: > > # fetch -rR /dev/ad0 > > Also recoverdisk could be useful. Maybe there's enough information > left to re-instantiate the file systems? Also try testdisk. > > When no file system can be re-instantiated, but you're sure > your data is still somewhere, you can use photorec for recovery. > It is able to recover a lot more than just photos. > > The ports collection contains further programs that might be > worth investigating; just in case they haven't been mentioned > yet: > > ddrescue > dd_rescue <- use this to make an image of the disk! > magicrescue > testdisk <- restores content > recoverjpeg > foremost > photorec > > Then also > > ffs2recov > scan_ffs > > should be mentioned. > > And finally, the "cure to everything" is found in The Sleuth Kit > (in ports: tsk): > > fls > dls > ils > autopsy > > Keep in mind: Read the manpages before using the programs. It's > very important to do so. You need to _know_ what you're dealing > with, or you'll probably fail. There is no magical tetroplyrodon > to click ^Z and get everything back. :-) > > Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer" > can still be considered worth a try. Their trial versions are for > free. "UFS Explorer" even works using wine (I've tried it). > > If you can remember significant content of your data, you can > even use > > # grep disk.dd > > to see if it's still in there. With magicrescue, you can try > something like this: > > # magicrescue -r /usr/local/share/magicrescue/recipes -d out > disk.dd > > where out/ is the directory where your results will be written to. > Keep in mind that _this_ approach will _not_ recover file _names_! > > > > > I know how bad it feels for such a "simple" mistake and I > won't make fun on you, pointing you to use your backups. > > Of course you always have the option to send your disk to a > professional recovery company. This substitutes learning and > trying yourself by impressive amounts of money. ;-) > > > > Good luck! > > Thank you very much, I am going to invest my time to try the valuable tips you shared. I admit the wrong step I made. Thanks again. > > -- > Polytropon > Magdeburg, Germany > Happy FreeBSD user since 4.0 > Andra moi ennepe, Mousa, ... >