0
3

[–] Genghis_Khan 0 points 3 points (+3|-0) ago  (edited ago)

I highly recommend not performing any actions directly on the drive. You can't (easily) control when the OS writes to the disk, so doing a low-level clone (with dd) of the disk to other media should be your first step, then put the source disk away until the recovery is complete. You should end up with a big fat iso (or other raw image) of the disk that you can mount and poke around in.

I did this exact procedure a few months ago and got a complete (partial) recovery just like you want. I need to get a beer to remember how exactly I did it.

DO NOT KEEP TRYING TO DO READ OPERATIONS ON THE DISK ITSELF or you might inadvertently overwrite more data. The dd you did probably pissed on the partition table, among other things.


Edit: Not going to lie, realizing all the stuff I was going to have to type to get out exactly what I did and how it worked...it's just not going to happen. However, I did find this pretty cool article that mentions moe's testdisk, as well as ddrescue and PhotoRec. I think these tools will probably get you what you need without you needing to understand how hard drives and filesystems work underneath. Good luck.

[–] [deleted] 0 points 3 points (+3|-0) ago 

[Deleted]

0
2

[–] Genghis_Khan 0 points 2 points (+2|-0) ago 

Delicious.