[Pc_Support] NTFS Recovery Information

[Carter Manucy]

Let me start with a 'stupid is as stupid does' story, then to the solution.

I had a 300G drive that was my data drive on a Windows 2003 Server.   In 
an effort to reduce the ridiculous number of servers I have in my house, 
I decided to install GSX server under Fedora.

All was well until I started playing around.  Note that playing around 
is generally a *bad* thing to do when you have any information that that 
you want to keep involved.  I thought I'd be smart about things and not 
mount the NTFS volume that had all of this information on it.  I'd gone 
and got two more 300G drives, which I planned to migrate to after I'd 
settled down my GSX install.  So I had the drive in the system and 
attached, but not mounted.

I eventually did get the system settled down, and I started figuring out 
the best way to migrate the data.  I was debating between using Samba 
and a share on a Windows box, so I decided to play around with different 
ways of doing things - using Samba on the host OS vs. using Samba and 
WFS under Windows on a guest OS.  It was at this point that things 
started to go bad...

While playing around, I wasn't paying attention in GSX, and accidentally 
gave one of the guest OS's direct access to /dev/sda ... which just 
HAPPENED to not only be the 'default' drive GSX offers up when you add a 
direct-access drive to the guest OS, but also my drive with the data I 
DIDN'T want to mess with.

Did I mention that I wasn't really paying attention when I was doing this?

So I mount the drive in one of the guest OS's... XP I think.  It didn't 
want to recognize the drive.  Couldn't mount it.  Wasn't importable.  I 
didn't think a whole lot of it because I'd been messing around with one 
of the 'scratch' 300G drives (note to self: having too many of the same 
size drive can be a BAD thing).  So I formatted it.

BAD MOVE.

It didn't take me too long to realize the drive I'd just formatted was 
the exact one I didn't want to touch.  So I did what most folks do in 
this situation... go ask the guy who knows more than I do about things 
what to do!

So I shot off an e-mail to Bryan Smith, who basically told me what I 
didn't want to hear - good luck, call a data recovery service - and 
quick, make a copy!

DAMN!  But I did have these 'extra' 300a drives ... so I immediately 
made an image of what was left of my 'good' drive with dd, and went to 
work with the new copy to see if I could do anything.

Many "data recovery" programs later and I wasn't feeling much better.  
Most of them showed exactly what I already knew - it wasn't looking 
good.  Then I came across another program called "GetDataBack NTFS".  
The site was a bit questionable, but I didn't have much to lose.  They 
claimed the same as the rest - save reformatted partitions, bad drives, 
blah blah blah... but this one actually WORKED.

So the next time you pull a bone-head move, there might still be hope 
for ya :)  It recovered all my files, directories and everything... the 
only bad part was I had to have another drive to copy the files off to - 
but I can live with a limitation like that. 

"Losing time to stupidity" should be my trademark...

Hope this helps someone else!

-Carter