Re: WAY OT--Crisis...virus! Need help

Ian Eure (ieure@crosssound.narrows.com)
Mon, 26 Apr 1999 10:27:48 -0700


Alan Cox wrote:
>
> > Seeing the same thing with two of my Win95 boxes and a friend's computer (we
> > don't even share files between ourselves). It wipes out the partition table.
> > ICK! Where did it come from, and is there any way to recover the data?
>
> Not easily. If you know roughly where things line up you can hunt for the
> unix superblocks and FAT tables. Keeping a copy of your partition tables
> on postits taped to the case isnt a bad idea. Its a bit late for that
> though.
>
> If you set one partition for the whole disk, that should let you back up the
> first partition you had at least. It may also let you know a size so you can
> hunt the next one
>
It is not impossible (although time consuming) to manually recover your
partitions. I had a problem with a Linux 2.0.30 box a while back (when
2.0.30 was the latest and greatest) and I had lost my partition table,
had no backup,and only a vague idea what the grometries should be. What
I found is that if you have a rescue disk, you can start with the first
partition, and guess. Then either mount it read-only and cat/cp every
file to /dev/null to check for errors or e2fsck -f -n; if you get
errors, try again. :)

Not very fun, but it is useful at (desprate) times.

-- 
+-------------------------------------------------------------------------+
| Ian Eure
<ieure@crosssound.narrows.com>                                 |
| Network Administrator, Cross Sound Appraisal
Company                    |
|                                                                        
|
| "Believe it or not, there's more to being a sysadmin than
rabid         |
| technophilia."         --Annalee Newitz, "Invisible
Heroes"             |
+-------------------------------------------------------------------------+

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/