Re: Photoscore

[David Kastrup]

David Wright <address@hidden> writes:

> The most important thing in this situation is not to panic.
> It's quite possible that only two things have been altered:
> the Master Boot Record may have been overwritten, and the
> partition types may have been altered in the absence of any
> other changes, in particular to their contents.
>
> So it should be worth booting from a live linux CD to mount the
> partitions to check their contents, and to reinstall Grub
> (or whatever you use to boot) into the MBR. (Modify the latter
> if you have a EFI disk rather than MBR.)

I am an old hand at recovering data.  The first measure is to buy a hard
disk of the same size or larger, hook it up to USB, and make a 1:1 image
copy.

Anything else is complete madness.  You don't start any recovery action
with this kind of scenario without an image copy.

Depending on the importance of the data, you store away the original
drive in case data recovery services need to look deeper than the drive
electronics will deliver (with modern magnetization densities and SSD
drives, however, even special recovery hardware does not deliver a lot
beyond the first-layer data).

Once you have an image copy, you can work on that and see how far you
get.

> Note that Linux used to use the same GUID as a Microsoft Basic Data
> Partition so these could be relict, or set by MS as a convenient
> "bucket" value.
> https://en.wikipedia.org/wiki/Microsoft_basic_data_partition

That's somewhat helpful information.  However, the partition type list
(which I got via the phone) was delivered by Linux' fdisk so it should
know (the system was partitioned not more than 4 years ago I think).

And the total size of the "Microsoft Basic Data Partition"s (without the
obvious actual C:) does not amount to a full Linux system.  I hope that
Windows sacrificed / rather than /home .

That will be my Christmas vacation.  Thanks, Nadella.

-- 
David Kastrup