Club Linux Coffs Harbour

Jesse, whom some of us met on Software Freedom Day, made the trip up from Kempsey for the last meeting and has a nasty problem. The problem was with a proprietary operating system, but as the solutions to problems with proprietary software almost universally involve free software, I think it's appropriate to ask for help here.

The symptoms sound very much like a screwed up partition table. The suspicion is that the cause was some sort of trojan that was delievered as an alleged "patch" to some proprietary software for MS Windows. After installing this software, Windows spontaneously rebooted (nothing unusual in that), but on boot-up the computer could find no bootable partitions. On further examination, there was no evidence of any partitions at all. Here's my list of possible solutions; please add any others that come to mind below.

The first step should be to make sure you don't do any further harm. Assuming that there's recoverable data on your drive, backing it up before attempting to recover it gives you a second chance if you screw something up. Backing up the drive with the 'dd' command will literally copy the contents of the drive bit-by-bit, preserving even deleted or otherwise inaccessible files and parts of files. You can run dd from any GNU/Linux-based live CD or system rescue CD, or you can stick the ailing drive into an existing GNU/Linux system. You will of course need enough free hard drive space to create the disk image. I just stumbled across a mention of a tool called 'dd_rescue' that claims to read stuff that ordinary dd gives up on, so that might be worth a try if dd fails.

If you happen to know the precise geometry of your partitions, you should be able to recover the partitions by just creating them anew with GNU Parted (or GParted - although I have known GParted to silently fail in instances where GNU Parted will give you useful error messages). This approach will of course work in instances where the affected disk is a single partition taking up the whole disk. Unfortunately in this instance, there were multiple partitions and the precise geometry is not known.

TestDisk is a tool designed to recover partition tables and boot sectors. I have tried this once in the past, without success, but it is well regarded and included on many system rescure CDs, such as the imaginitively named SystemRescueCD. There's some similar software called gpart, which I've not used.

You might also want to browse through Freshmeat's list of system recovery tools.

Should higher-level solutions fail, you may be able to recover some of your irreplaceable data using PhotoRec. As the name suggests, this was originally designed to recover photographs from damaged disk drives, memory cards, and so on, but now recovers over 80 diffent types of files. It works it's way through your hard drive bit by bit, recovering anything that looks like it might not be gibberish. Be warned, though; it cannot recover file names, so what it recovers is randomly-named, and you have to sort it out yourself. Moreover, it won't just recover existing files but deleted files and chunks of partially-overwritten deleted files, so you may end up wading through thousands of files, including old versions of the same files.

Anybody else have any suggestions, or tools that have worked for them in the past?