# A big mistake!



## hirohitosan (May 18, 2010)

Hi guys!
I made a huge mistake! During installing FreeBSD on one of my computer I accidentally format (UFS) an USB HDD (fat32) attached to that computer. There are any chances to recover my data?
thanks!


----------



## Beastie (May 18, 2010)

Try PhotoRec, but I have no idea if you can get much back.

Good luck anyway.


----------



## Ruler2112 (May 18, 2010)

Recuva, Zero Assumption Recovery, and GetDataBack might help.  (Got data back from an SD card for a friend when his kid hit format on his camera a few months ago.)

Depending on how the UFS format works, you *may* be able to simply go into fdisk and change the type back to FAT32 (I think 0c).  If the UFS format overwrote the FAT though, this won't work.  I'd probably try this first; you can always change it back to UFS and the only thing that would be written out is the file system descriptor bit in the partition table.


----------



## eyebone (May 18, 2010)

there are as well several unix forensic tools like autopsy. give it a shot, i am pretty sure u will be successful, afaik UFS is not NULLing the space, so u should be able to recover most of your files. good luck!


----------



## jb_fvwm2 (May 18, 2010)

1... do you have backups of the fat32?
a... maybe "dd= ... (stuff)" to backup the disk (raw)
to a spare drive that is at least the same size.
and operate on one of the two results.
if so, maybe make a file:  (unless you know of another way)
(call it, fix_file.txt)

p 1 11 * 8G  




```
fdisk -f fix_file.txt -v -u /dev/[disk]
```
(that [disk] will probably be the shorter of the 
drives's names in /dev, the install probably created lots.
...
check that file syntax first in "man fdisk...", no time here. !!  Also that 8G was specific to this machine
and probably is totally USELESS in your specific
case, making the command damaging without a proper
number.
*if fdisk will see the disk
* that might "just" fix the fat table, or it may 
...make it unrecoverable.  I don't really know.
...there are also other fat32 types (15 I think...)
...that (maybe) should be used instead of 11...


----------



## hirohitosan (May 20, 2010)

thank you guys!
I installed PhotoRec and for a few day it's spinning the HDD. It recover a lot of files but the filenames are changed. So I'll wait until finish and see what't happen.


----------



## Beastie (May 20, 2010)

Also, when you recover files, check their validity. These utilities work at their optimum when filesystem fragmentation is low. If the FS is very fragmented and the FAT and its backup have been overwritten during the newfs, the utility may have a hard time guessing the file parts' locations and you may get a lot of corruption, with truncated files or files bearing the tails and heads of others.


----------



## hirohitosan (Jun 18, 2010)

look what I done:
first I created as root a text file fix_file.txt where I added p 1 11 * 8G. My external HDD is da0 so 

```
u# fdisk -f fix_file.txt -v -u /dev/da0
******* Working on device /dev/da0 *******
parameters extracted from in-core disklabel are:
cylinders=38913 heads=255 sectors/track=63 (16065 blks/cyl)

Figures below won't work with BIOS for partitions not in cyl 1
parameters to be used for BIOS calculations are:
cylinders=38913 heads=255 sectors/track=63 (16065 blks/cyl)

Information from DOS bootblock is:
1: sysid 15 (0x0f),(Extended DOS (LBA))
    start 63, size 16771797 (8189 Meg), flag 0
        beg: cyl 0/ head 1/ sector 1;
        end: cyl 19/ head 254/ sector 63
2: <UNUSED>
3: <UNUSED>
4: <UNUSED>
fdisk: Class not found
```
I don't understand the message ...
does it works or not?
I can mount the disk:
	
	



```
u# mount /dev/da0s1e /mnt/hdd-extern/
u# ls /mnt/hdd-extern/
.snap           games           libdata         sbin
PCBSD           home            libexec         share
Programs        include         local           src
X11R6           jails           portjail
bin             lib             ports
```


----------



## aragon (Jun 18, 2010)

The "Class not found" message relates to fdisk not using GEOM.  It can be safely ignored.

Try gpart(8) sometime instead of fdisk...


----------



## hirohitosan (Jun 19, 2010)

thanks aragon. As I mentioned before I accidentally format a FAT32 partition with UFS and now I want to restore if it possible the FAT32 partition.

```
# gpart show
=>       63  625142385  da0  MBR  (298G)
         63   16771797    1  !11  (8.0G)
   16771860  608370588       - free -  (290G)

=>       0  16771797  da0s1  BSD  (8.0G)
         0   4194304      1  freebsd-ufs  (2.0G)
   4194304   8384512      2  freebsd-swap  (4.0G)
  12578816   2097152      4  freebsd-ufs  (1.0G)
  14675968  610455552      5  freebsd-ufs  (291G)
```
this is the disk that I formatted. It is possible to recover the information that was lost by formatting? I never used gpart or fdisk utility and I'm not used with them. As I understood from jb_fvwm2 it is possible to restore the FAT32 table and to recover my data.

It is correct?
thanks


----------



## Beastie (Jun 19, 2010)

hirohitosan said:
			
		

> it is possible to restore the FAT32 table and to recover my data.


Very unlikely. The most important structures in a FAT32 FS are the "root directory" which starts at the beginning of the data area and (usually) 2 copies of the FAT linked list which are stored at the very beginning of the partition. Both were most likely overwritten entirely when you newfs'ed the slice. Once that is done, all your data is nothing more than millions of clusters scattered everywhere on the slice with no connection and identity.
The only *possible* solution is the one I already proposed: PhotoRec.


----------



## hirohitosan (Jun 19, 2010)

thanks Beastie. I recovered with PhotoRec and Get Data Recovery many of my files but before to reformat my HDD I wanted to try gpart of fdisk method described above. 

Thanks again guys!


----------



## aragon (Jun 19, 2010)

Oops, late post.  Well done Hiro!


----------

