hi,
On Mon, 2004-09-27 at 15:05, Tobias Herp wrote:
> I have accidentally deleted another NTFS partition than I thought I did;
> now I have a deleted 57GB NTFS partition which has been partly
> overwritten with a 5GB ext3fs partition (1.7GB used) and 2GB swap. There
> has not happened very much on these since, so it should be possible to
> get back most of my data.
>
> So, what should I do?
>
> For security reasons, I reckon it would be wise to create images of the
> new partitions (and now unused space). I'd like to avoid to create an
> imoage of the entire 120 GB disk, since the affected part covers 57 GB
> and I have another 80GB disk in spare which I could use for the image.
>
> What would happen if I just deleted the new partitions and
> re-established the deleted NTFS partition without (long-) formatting
> it?. Is there a tool which would help me to get data back from this?
No if you did a format it would destroy all your existing metadata and
that would be very bad. However you should delete the partition and
recreate it as it was before (using fdisk for example) but do NOT format
it. You might then be able to mount it with the Linux ntfs driver with
the on_errors=recover mount option. IF that fails you can try to just
get data back with any of the recovery programs available on the net.
You might want to try TestDisk for example.
(http://www.cgsecurity.org/index.html?testdisk.html)
You could also try running chkdsk on the drive but windows might well
wipe everything instead of fixing it.
And of course you can pay someone to get what data there is left back.
Hope this helps.
Best regards,
Anton
--
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK
Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net
WWW: http://linux-ntfs.sf.net/, http://www-stu.christs.cam.ac.uk/~aia21/
|