Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 27 Jun 2013 09:47:17 +0200
From:      Polytropon <freebsd@edvax.de>
To:        KK CHN <kkchn.in@gmail.com>
Cc:        freebsd-questions <freebsd-questions@freebsd.org>
Subject:   Re: Retrieving a FreeBSD installation
Message-ID:  <20130627094717.a3bab5aa.freebsd@edvax.de>
In-Reply-To: <CAKgGyB_QzfunV_4jVZ+A_rAtvVf7SfEeL=taiuoVvVwCX6SZew@mail.gmail.com>
References:  <CAKgGyB_QzfunV_4jVZ+A_rAtvVf7SfEeL=taiuoVvVwCX6SZew@mail.gmail.com>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Thu, 27 Jun 2013 07:28:49 +0000, KK CHN wrote:
> List,
> 
>   I accidentally installed  a Linux variant(mint OS) on my Harddisk
> where  FreeBSD is installed( which contains my data).
> 
> Is there a  possibility  to retrieve that FreeBSD Installation which
> is overwritten by Linux installation.

In most cases: What has been overwritten is lost.

But: What has "only" been disallocated (data still on disk)
can _sometimes_ be recovered.

So it depends on _what_ is still left.

Anyway, do not do anything with the disk. Do not try any
recovery on the disk itself. Make an image of the disk and
use that image file for any further action. In case you
damage it, make a new copy. Only work with copies. One wrong
step can massively decrease your chances of recovery.



> Any hints  welcome!

It will be a very hard thing. You will probably have a lot
of "trial & error" experience, and you will surely learn a
lot, for example about file systems.

I've written about this topic on this list already, and I
will again re-use some details from a previous post to make
a list for what you can try.

Boot from a live CD or USB stick or a different disk. Then
make a copy of the disk using

	# dd if=/dev/ad0 of=disk.dd

where /dev/ad0 is the disk you have accidentally overwritten
your OS installation. In case the disk makes any trouble, use
dd_rescue or ddrescue (from ports).

You can also try this:

	# fetch -rR /dev/ad0

Also recoverdisk could be useful. Maybe there's enough information
left to re-instantiate the file systems? Also try testdisk.

When no file system can be re-instantiated, but you're sure
your data is still somewhere, you can use photorec for recovery.
It is able to recover a lot more than just photos.

The ports collection contains further programs that might be
worth investigating; just in case they haven't been mentioned
yet:

	ddrescue
	dd_rescue	<- use this to make an image of the disk!
	magicrescue
	testdisk	<- restores content
	recoverjpeg
	foremost
	photorec

Then also

	ffs2recov
	scan_ffs

should be mentioned.

And finally, the "cure to everything" is found in The Sleuth Kit
(in ports: tsk):

	fls
	dls
	ils
	autopsy

Keep in mind: Read the manpages before using the programs. It's
very important to do so. You need to _know_ what you're dealing
with, or you'll probably fail. There is no magical tetroplyrodon
to click ^Z and get everything back. :-)

Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer"
can still be considered worth a try. Their trial versions are for
free. "UFS Explorer" even works using wine (I've tried it).

If you can remember significant content of your data, you can
even use

	# grep <pattern> disk.dd

to see if it's still in there. With magicrescue, you can try
something like this:

	# magicrescue -r /usr/local/share/magicrescue/recipes -d out disk.dd

where out/ is the directory where your results will be written to.
Keep in mind that _this_ approach will _not_ recover file _names_!




I know how bad it feels for such a "simple" mistake and I
won't make fun on you, pointing you to use your backups.

Of course you always have the option to send your disk to a
professional recovery company. This substitutes learning and
trying yourself by impressive amounts of money. ;-)



Good luck!



-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?20130627094717.a3bab5aa.freebsd>