[GLLUG] data recovery & RSVP

[Charles Ulrich]

On Wednesday 09 March 2005 21:34, David Smith wrote:
> I'll be coming tomorrow.
>
> A couple weeks ago I lost a lot of data.
>
> I used cfdisk to create a partition
> /dev/hdh1
>
> Then i did mk2fs /dev/hdh
>
> Then I mounted /dev/hdh.

These two commands are highly suspect. Just to confirm, you did mk2fs and 
mounted /dev/hdh, NOT /dev/hdh1, right? If so, this would be the start of 
your problems. /dev/hdh is your whole hard disk while /dev/hdh1 is a primary 
partition on the disk.

> I then copied roughly 240GB data to it.

With cp? And verified that the data was there afterwards?

> After I restarted my computer, the drive wouldn't mount.

You don't mention here whether you tried to mount /dev/hdh or /dev/hdh1 after 
reboot. Assuming that there are no typos in your message above, 
mounting /dev/hdh rather than /dev/hdh1 should work since it worked when you 
copied the data to it.
 
> I used dd to copy /dev/hdh to another 250gb hard drive.

Very sensible. This is the first thing to do when you suspect you've horked a 
disk with valuable data on it. By chance are the drives identical models? If 
not, there might be a few cylinders difference in size and this will almost 
certainly affect how well dd works. (Side note: If one disk is significantly 
smaller than the other, you're better off dd'ing the first to a file on the 
second so that you can always just copy the image back to the first disk 
rather than messing around with block sizes and counts.)

> After the data was copied I created a partition /dev/hdh1 and did mk2fs
> /dev/hdh1.
>
> Then I used dd to copy the data back.  There was an error at the end
> because the drive was out of space (I'm assuming the space the partition
> table takes up).

This sounds about right, unfortunately. 

Snipped the rest, since at this point you seem to have a completely unusable 
filesystem on the first disk. It's probably not recoverable without some 
rather specialized forensic techniques involving intricate knowledge of the 
ext2 filesystem.

Try putting the second disk in the system and mounting /dev/hdh as mentioned 
above and let us know what you get. If you don't have any luck, bring the 
system and drives to the meeting and we can try to help.

Charles
-- 
http://bityard.net