Track history of OS...
 
Notifications
Clear all

Track history of OS installations

5 Posts
3 Users
0 Likes
625 Views
(@work-hardy-n)
Posts: 2
New Member
Topic starter
 

A computer with dual boot using GNU Grub exists.

Currently, Ubuntu on one partition and Fedora on another.
But the partition that has fedora previously had another version ubuntu on it, and before that had windows 7.
Is there any way/logs to tell when(date) each of the OS were installed on the partition, which currently has fedora.

Fedora resides on ext4, ubuntu previously was on ext4 and windows 7 before that was on ntfs, not sure if file system type makes any difference at all.

 
Posted : 24/12/2018 1:20 pm
(@forensicallychallenged)
Posts: 7
Active Member
 

I may be wrong(feel free to correct me) however if you reformat a partition from NTFS to EXT4 or vice versa, the previous data would be unreadable due to the differences in the data structure.

 
Posted : 25/12/2018 12:21 am
(@work-hardy-n)
Posts: 2
New Member
Topic starter
 

Hi,
I am a complete newbie, so I wouldn't know too much about the affiliated logic underneath. I am not trying to do data recovery from the previous installation. In my scenario, ruling out the need for data recovery helps, as in, if the history of dates of OS installation warrant a data recovery situation, I would instead be recreating the data in a certain way that I think it existed in history. If it doesn't warrant, I don't need to recreate my data, I might be more or less all set with the existing data at hand.

Is there like an entity(either the GNU Grub/existing dualboot software or something else), which tells us there existed an OS at a certain date, or an OS was installed on a certain date in history.
Conceptually, if GNU Grub or something else is allowing me to boot into multiple OS installations, it makes me think it would keep log of when one of the OS partitions changed into a different OS. I wouldn't be surprised if I am completely wrong, just a question, if the answer existed, hoping to save me a lot of data crunching work.

 
Posted : 25/12/2018 12:15 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I may be wrong(feel free to correct me) however if you reformat a partition from NTFS to EXT4 or vice versa, the previous data would be unreadable due to the differences in the data structure.

Yes and no.
Meaning that if you "quick format" a volume without changing its size, two possible cases
1) you format it with the same filesystem as before (and under the same OS) 99.9999% of the time all filestem data structures will be overwritten
2) you format it with a different filesystem (and in some cases also with the same filesystem on a different OS) filesystem data may (entirely or partially) "survive".

A typical example is if you re-format a NTFS hard disk volume as FAT32.

ALL the filesystem structures of the NTFS filesystem, with the exception of the $Boot file, which however is not of particular importance, normally reside at a relatively high offset (the $MFT is by default on any volume bigger than 5-6 Gb on cluster 786432 i.e. normally sector 6291456).

ALL the filesystem structures of the FAT32 filesystem (the FAT tables) are instead at the very beginning of the volume, and are very unlikely to overwrite any of the NTFS ones.

Cannot say about EXT2/3/4, but I believe that at the most it will "make holes" in the underlying NTFS structures.

jaclaz

 
Posted : 26/12/2018 10:52 am
(@forensicallychallenged)
Posts: 7
Active Member
 

Thank you for the clarification.

 
Posted : 28/12/2018 7:06 am
Share: