Hi. I have a couple of questions for a rescue-scenario I´ve trying for a while. I just realised that I might be taking the wrong approach.
I´m running opensolaris and a while ago I accidentally "erased" 200gb of data due to a faulty management software. What happened was that the software erased the current partition table and created a new one. I have tried various approaches to get my data back and/or to restore the original partition table through the backup labels that I´ve heard should be stored for each disk. The restoring of the partition table has not worked for various reasons and I´ve come to the conclusion that it would probably be easier to just copy the data to another disk. I know that the data is still there because when I tried out a bunch of restore software for linux and windows I actually found one that could read and show me my data (Stellar Phoenix). This software is unfortunately way out of my budget and none of the others I´ve found can read solaris partitions except ddrescue.
The problem though, is that in my case, ddrescue seems to read only the empty inodes from the new partition table (which of course consists of the whole disk). Is there a way around this? Is this when I should start thinking of reading the raw device instead (which I´ve also tried btw)?
the commands I´ve tried so far looks like this, where c0d1 is the faulty disk, 200gb in size, and c2d0 is a new disk, 400gb in size, which I´ve partitioned as a single large partition and created a filesystem on (which became slice 0). c0d1s2 refers to the backup partition on the old disk which I though at least theoretically could include my missing data (I´m uncertain of this one)
I´ve also tried reading the raw device, something like:
ddrescue -B -n /dev/rdsk/c0d1s2 /dev/dsk/c2d0s0 rescued.log
both commands reads a lot of data to the new disk. when I fsck the new disk I get a lot of errors about either wrong superblocks or incomplete inodes etc. The raw read seems to be worse than the block read and usually includes large number of negative sizes for the inodes. If I let fsck solve the problems it found and I mount the partition, I end up with something that seems to be a empty. This make me think that I´ve been trying to
a) read 200gb of empty data b) read something but then "wiped" the corrupt/incomplete data to zero again c) read the wrong thing, the wrong way. d) that there is some sort of incompability of the block sizes of the old and the new disk
any ideas, thoughts, suggestions is greatly appreciated. It´s very possible that I´ve missed something important, please let me know if so.