Looking for an undelete/unformat program

[telephoto]

You can't kick me harder than I am kicking myself.

I had a file (abc.xls) on a laptop with partitioned windows HDD.
The laptop was old and was replaced, data was transferred.
Linux (Ubuntu) was installed on the laptop in one big partition as a learning experiment.

The file abc.xls has gone missing....

I am looking for a program to interrogate the Linux drive and recover a windows .xls program - that was on the drive before linux installed itself - , assuming it has not been overwritten.

I have contemplated ddrescue/dd_rhelp but these appear to be for current files on a damaged disk?

Before I dig any further, does anyone have any favourite programs that might work?

TIA

Telephoto

 

[danomac]

I've used a tool to try to recover something on an ext3 partition before, but if you are talking about trying to recover a file that existed on a Windows-formatted partition prior to converting to ext3 (which is what it sounds like) I know of no tools that can help you.

About the only thing I can think of is a partition hex editor in read only mode. This of course assumes you know of something that might be plaintext in the file. Lots of work ahead of you.

I got burned by this once (hard drive failure, now I make regular backups) and tried the above hex-editor solution. It turned out to be too time intensive to do. Once you have a start and stop point you might be able to use dd.

 

[telephoto]

Thanks for your reply danomac, a couple of quick questions:

reading a bit about dd_rhelp it uses dd_rrscue, but seemed to be a quicker version, one which would be better for a drive without faults, but is it only for use to recover files saved and then deleted by that operating system (which would be Linux and therefore no good)?

I have not come cross a hex-editor before, but with a year-old backup I should be able to find some contiguous text. Can you point me at one please?

TIA

telephoto

 

[danomac]

The last time I needed something I used lde. It allows you to look at blocks on the disk and write them out. Whether or not it'll help you with your problem is another story.

dd will literally just read whatever it stored on the blocks of the disk. I don't think it has a way to search the disk. If you can find out what blocks the file is located in, either lde or dd can be told to write those blocks to a file.

Another thing that might work (if you use KDE) is khexedit. One of those tools should be able to search for a string on a device. Once you find that then you need to try to figure out where the start and stop of the file is, which can be interesting.

I would suggest using a different OS drive and mounting the one at fault read-only. The longer you use the drive/partition the higher the probability that your file will get overwritten.

Keep in mind that when linux formats ext2/3 it writes blocks every once in a while on the disk/partition so your file may already be gone.

 

[Annihilannic]

PowerQuest's Lost & Found (discontinued now I believe) used to be good for this sort of thing... may be worth a go if you can find a working version.

Annihilannic.

 

[IPGuru]

Photrec is als quite good at finding files if the format is known, but I think anything is a long shot at present.

 

[kjv1611]

Have a look at the UBCD - Ultimate Boot CD - you boot from it, so it really doesn't matter what OS you have/had installed. Browse through it's different recovery programs.

Also, considering it was a Windows partition before, I'd suggest looking at:

GetDataBack

and/or

Active Partition Recovery

and/or

Active Undelete

All 3 are very good programs. They aren't free, but they're cheap compared to other pay programs. Also, if you want to rather try and recover the old partition to a different hard drive as an image file, and THEN search through it, you can use Active Partition Recovery for free.

--

"If to err is human, then I must be some kind of human!" -Me