2

I know the probability of this is very low, but I have a 250G hard drive that I just reformatted and re-installed the OS on (centos, ext3). It turns out there was one large file (a 20G xen image) on that disk that we should have saved. The hard drive was about 80% full before the install, and now it only has about 10G written to it, so in all probability the actual sectors the file used to reside on were not overwritten by the install process (though the format may have cleaned everything out)

Is there any chance of recovering that file? Or did the format / reinstall wipe out all residual traces of it?

2 Answers 2

2

I have had good results recovering files from ext2 and vfat formatted disks with TestDisk and Photorec. Photorec can recover some surprising kinds of files. The programs are arcane but definitely try it.

1

I'd say your chances of recovering the file in it's entireity are awfully close to zero. The format itself won't have wiped the disk clean, but disks in use for any length of time aren't always full from the beginning -- there are usually empty holes everywhere, and when you put more data in (like a big image) bits of it will have likely ended up near the beginning of the disk where your reinstall now lives.

If it's crucially important, a forensic data recovery place might be able to get at it, but it'll cost a bomb, take ages, and with no guarantee of results. I'd use it as an object lesson in why you should remove and quarantine disks for a period when you reuse a machine -- and why you should have backups. Lots and lots and lots and... (etc)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .