Accidentally initialize a HDD at installation

[notooth]

Hello,

I accidentally initialize a HDD which contains data at installation. Is there a way to rescue it?

[jggimi]

It depends on how much data was destroyed. The word "initialize" may have many meanings. Allow me to provide examples for possibile "initializations."

• You have overwritten only the MBR. Recovery of the partition table/tables, partially or completely might be possible -- there are forensic tools which can scan a drive looking for filesystems.
• You have overwritten boot blocks. Recovery may be possible, depending on the operating system involved. You should be able to recover data, even if you cannot recover an installed OS.
• You have overwritten a disklabel. This is the same as overwriting the MBR partition table(s). There are forensic tools which can scan a drive looking for filesystems.
• You have formatted new filesystems. Time to restore from backup. If you didn't bother to back up your data, you have now experienced "data loss." We all have experienced it, which is why we back up our data.
  

[notooth]

Hi jggimi,

This is what I did to my HDD. It was:

$ sudo disklabel sd1
# /dev/rsd1c:
type: SCSI
disk: SCSI disk
label: ST2000LM003 HN-M
duid: c1747308bf9d28ef
flags:
bytes/sector: 512
sectors/track: 63
tracks/cylinder: 240
sectors/cylinder: 15120
cylinders: 258401
total sectors: 3907029168
boundstart: 0
boundend: 3907029168
drivedata: 0 

16 partitions:
#                size           offset  fstype [fsize bsize  cpg]
  c:       3907029168                0  unused                   
  i:       1999998976             2048  ext2fs                   
  j:       1907028144       2000001024    NTFS

then I changed the file system of the partition i to 4.2BSD and wrote data to it. After that, when I installed a new OpenBSD on sd0, it asked me if I wanted to initialize a second hard disk, I chose the sd1. I thought "initialize" was to mount the sd1 at boot for ready to use, but it change my HDD to:

$ sudo disklabel sd1
Password: 
# /dev/rsd1c:
type: SCSI
disk: SCSI disk
label: ST2000LM003 HN-M
duid: 0000000000000000
flags:
bytes/sector: 512
sectors/track: 63
tracks/cylinder: 240
sectors/cylinder: 15120
cylinders: 258401
total sectors: 3907029168
boundstart: 64
boundend: 3907023120
drivedata: 0 

16 partitions:
#                size           offset  fstype [fsize bsize  cpg]
  c:       3907029168                0  unused

[jggimi]

At the very least, you have zeroed the disklabel. You have likely overwritten the MBR and reserved space for an OpenBSD MBR partition (type 0xA6).

Step 1. See if the MBR has been overwritten. If there is now a single MBR partition (slot #3), of type 0xA6, then the MBR has been overwritten. # fdisk sd1

If it has, you can recreate it with fdisk(8).

Step 2. Before following this "how to", read the fdisk(8) man page. I'm just typing this up from memory, and I may make a mistake. Do not blindly follow these instructions.

Step 3. Enter the fdisk(8) MBR editor. # fdisk -e sd1

Step 4. Delete the OpenBSD partition by changing its partition type to 0x00. fdisk> e 3 followed by "0" at the next prompt.

Step 5. Create the Linux partition in slot 0. fdisk> e 0 followed by "83" at the next prompt. You will be asked if you want to edit in CHS mode. Reply "n", which is the default. You will be prompted for an offset (starting sector number). Reply with "2048". You will be prompted for a size. Reply with "1999998976".

Step 6. Create the NTFS partition in slot 1. fdisk> e 1 followed by "7" at the next prompt, and "n" to the edit in CHS mode at the prompt which follows. Use "2000001024" for the offset and "1907028144" for the size.

Step 7. Write the new, revised MBR partition table and exit the program. fdisk> q followed by "y" at the final prompt.

[jggimi]

I'll add that these instructions do not restore boot blocks. If the Linux system was bootable, you can use the fdisk editor's "flag" command to flag MBR partition 0 as bootable. But this will only work if there is a partition boot record (PBR) in sector 2048. As Linux typically boots with grub or lilo, there may not be a PBR at that address.

[blackhole]

It's very easy to slip up and destroy data when working with multiple disks, especially when one of those disks is one which you want to keep.

The OpenBSD installer is designed to be comprehensive and simple, it is not a baby sitter and if you make an error it can be very unforgiving. I cannot suggest more than the above (excellent) advice. But I actually think your pursuit of mounting Linux file systems is causing most of the grief here. I would suggest a simple FAT volume for data sharing.

[jggimi]

A simple "finger fumble" can cause catastrophic data loss.

In this case, if either of these partitions require booting, then notooth will require specific boot-program knowledge to recover them, or OS-specific recovery tools, or both.

MBRs contain both a master boot program and the primary partition table. OpenBSD uses a chain-loading master boot program, MBR -> PBR. If memory serves correctly, many other operating systems, such as Linux and Windows, do not. Their master boot programs load boot managers instead of partition boot records.

[notooth]

Hi jggimi,

That is awesome. You've just saved my data. Thank you very much

[jggimi]

You were lucky, because you had a record of the original MBR partition table.

If you hadn't had that, you'd need to install and run SleuthKit utilities, or Autopsy, or similar forensic tools in order to scan the drive sector-by-sector hunting for likely filesystem signatures.

[notooth]

I was very lucky indeed