Recovery FFS formatted partition

classic Classic list List threaded Threaded
11 messages Options
Reply | Threaded
Open this post in threaded view
|

Recovery FFS formatted partition

Pablo Velasco Fernández
Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
installation I format by mistake my second hard disk with all my videos,
texts, pictures etc... Thank you for you attention.

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Amit Kulkarni-5
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.

what was the exact command by which you formatted?

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

ropers
In reply to this post by Pablo Velasco Fernández
I don't know enough to comment on the possibility of recovering the
entire partition, but I can tell you that it may definitely be
possible to recover some individual files based on their magic
numbers. Google file carving, magic numbers, etc. You can do it
manually with a hex editor -- there also are file carving programs
such as foremost/scalpel, but I'm not sure if these have ever been
ported to OpenBSD. Of course your first order of business should be to
make two copies (one backup, one to experiment on) of the entire hdd
this happened with. Use dd to copy the device to a file. Then hash
that file and stash the backup copy and the physical hdd somewhere
safe and don't touch them. (Disconnect the physical hdd.) Only work
with the second copy and compare the hash to see if it's still
unaltered -- restore from the backup copy if you mess up. Good luck.

2011/8/17 Pablo Velasco Fernandez <[hidden email]>:
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

STeve Andre'
In reply to this post by Pablo Velasco Fernández
On 08/17/11 17:30, Pablo Velasco Fernandez wrote:
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.
>
>
R-Studio is a good package for digging into filesystems.  I've
used it a couple of time on Windows disasters, and now an
OpenBSD disaster where I accidentally re-partitioned an
disk, and started a format before stopping it.  It's about
$79 for it.  The obnoxious part about it is that it only runs
on the CPU that you bind it to, but if you deal with disks,
having a system do this isn't that hard.

--STeve Andre'

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Martian67
In reply to this post by Pablo Velasco Fernández
On 8/17/2011 3:30 PM, Pablo Velasco Fernandez wrote:
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.
>
>

you may want to check out photorec, its in the ports tree and is
filesystem agnostic, it should be able to recover the bulk of the data.

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Kevin Chadwick-2
In reply to this post by ropers
On Thu, 18 Aug 2011 02:57:42 +0200
ropers <[hidden email]> wrote:

> Google file carving, magic numbers, etc. You can do it
> manually with a hex editor -- there also are file carving programs
> such as foremost/scalpel, but I'm not sure if these have ever been
> ported to OpenBSD

There's no equal substitute for getting down and dirty but testdisk in
ports would be my first port of call. This and clonezilla never used
to support OpenBSDs FFS, but they do now.

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Ryan McBride-3
In reply to this post by Pablo Velasco Fernández
On Wed, Aug 17, 2011 at 11:30:05PM +0200, Pablo Velasco FernC!ndez wrote:
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.

In the past I've used the TCT (The Coroner's Toolkit) to recover from an
accidental rm -rf * in /; it's been superseded by TSK (The Sleuth Kit), which
also works on OpenBSD:

http://www.sleuthkit.org/sleuthkit/desc.php

You might want to have a look at File UNDeLeter (which uses TSK):

http://sfdumper.sourceforge.net/fundl.htm

I'll repeat what others have said: as in real forensics, make 2 copies
of the original drive on other media; work from one of the copies and
recover from the backup copy rather than touching the original drive
again until you're satisfied you have all the files you want. Yes,
you'll need lots of storage for this. Get it, and when you're done
recovering files, you will have the disk space to make some backups.

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Gregor Best
In reply to this post by Pablo Velasco Fernández
On Wed, Aug 17, 2011 at 11:30:05PM +0200, Pablo Velasco Fernandez wrote:
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.
>

binwalk should also do the trick, along with the other tools mentioned
around here. It is not in the ports tree, but it compiles fine from
source.

--
    Gregor Best

[demime 1.01d removed an attachment of type application/pgp-signature]

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Pablo Velasco Fernández
OK, thanks to all your comments

2011/8/18 Gregor Best <[hidden email]>

> On Wed, Aug 17, 2011 at 11:30:05PM +0200, Pablo Velasco Fernandez wrote:
> > Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> > installation I format by mistake my second hard disk with all my videos,
> > texts, pictures etc... Thank you for you attention.
> >
>
> binwalk should also do the trick, along with the other tools mentioned
> around here. It is not in the ports tree, but it compiles fine from
> source.
>
> --
>    Gregor Best
>
> [demime 1.01d removed an attachment of type application/pgp-signature]

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Alexander Hall-3
In reply to this post by Pablo Velasco Fernández
On 08/17/11 23:30, Pablo Velasco Fernandez wrote:
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.
>

I chime in with the testdisk/phootrec choir. I don't remember which, but
they come in pair. If has helped me tremendously in the past when my
brother screwed up in a similar fashion.

A warning though - it will also find all those nasty files you thought
you deleted from your browser cache... ;-)

/Alexander

Reply | Threaded
Open this post in threaded view
|

Re: Recovery FFS formatted partition

Stuart Henderson
In reply to this post by Pablo Velasco Fernández
On 2011-08-17, Pablo Velasco Fern?ndez <[hidden email]> wrote:
> Hi all. Its possible to recovery a FFS partition? During my last OpenBSD
> installation I format by mistake my second hard disk with all my videos,
> texts, pictures etc... Thank you for you attention.

If you just overwrote the disklabel or fdisk partition information,
then scan_ffs is your friend.