Never write anything to a disk you are trying to recover data from
Also, if possible, make an image of the disk with dd
, ddrescue
or whatever suits you.
Download a linux live cd (I strongly recommend System Rescue CD)
Use testdisk to recover the old partition table. This would be the basic steps:
- Run
fdisk -l
to find out your disk device node
- Run
testdisk </dev/sdX>
replacing accordingly
- Selectthe partition table type (usually
Intel
)
- Select the
Analyze
command
From here on, it depends on whether it found your lost partition and it's recoverable. Follow the step by step guide for more detailed steps.
If testdisk
didn't manage to find your lost partition, chances are part of the information got overwritten. A good choice now would be to use photorec to try to recover as much files from it as you possibly can.
photorec
will read the disk bulk and use heuristics to recover as much files as it can from the raw data. It will be up to you then to browse through the recovered files and find what's useful and what's not.
Both testdisk
and photorec
are included in System Rescue CD.
EDIT:
You could also try to make an image of the unallocated space only, and run photorec on that image. It should be faster. I assume you already have an image of the disk at image-file
:
bash # sfdisk -l -uS image-file
Disk image-file: 0 cylinders, 255 heads, 63 sectors/track
Units = sectors of 512 bytes, counting from 0
Device Boot Start End #sectors Id System
image-file1 * 2048 206847 204800 83 Linux
image-file2 206848 4401151 4194304 82 Linux swap / Solaris
image-file3 4401152 312581807 308180656 83 Linux
image-file4 0 - 0 0 Empty
So from this info we know the block size is 512 and the last partition ends at 312581807. We need to extract from there on:
dd if=image-file of=unallocated-space bs=512 skip=312581807
Source.