Re: trying to recover data

[Andrew Clausen]

On Sat, Apr 26, 2003 at 04:02:20PM -0500, Eliot Landrum wrote:
> Here's the stupid part. I forgot that my /incoming directory was a 
> symlink to a directory on #4. So before rebooting, I copied a directory 
> of mp3s from a friends computer to /incoming. Stupid. Stupid. Stupid. 
> I'm banging my head against the wall over this.

You shouldn't have had it mounted at all!

> I just now came back to Linux and ran parted again. It doesn't look like 
> the partition has changed any. The printout is the same as before. I 
> don't know the nitty-gritty about file systems, but I was thinking that 
> the data is just not aligned right with the FAT. Maybe parted moved all 
> of the data, but then the FAT got messed up when I copied those files to 
> the partition. Is that close to reality?

Maybe... more likely, if it was mounted during the resize, there
was all kinds of cache incoherency, etc, so you've got a tangled
mess of both versions of the file system.  (It depends on how much
writing you did before and after the resize as to how bad the situation
will be)

> So... what do I do next? Is there any hope? I really, really would like 
> my files back. The good thing is that I haven't made any other changes 
> to that partition. I just had data on there, so no programs are making 
> changes to it as I go from Linux to Windows.

Step 1 is to copy the entire disk as a backup.  You can use cp for this.
(cp /dev/hda /dev/hdb, or similar).

Then, see how much scandisk & friends can help.  Then see what fragments
of data you can find by searching for strings.

Cheers,
Andrew