data recovery question

Hi there.

I have a data recovery problem and I'm wondering if there is a clean
solution.

We have a disk that once had linux on it. User decided to upgrade,
allowed Mandrake to repartition the disk, and it repartitioned both his
Linux and Windows disk. So he stopped the install to see if the Windows
disk could be saved. He ran Nortons unformat on the windows drive. That
one seems to be toast. Lots of data but no structure left. The Linux
drive is also a mess - since it has a different partition structure than
originally. I don't think he allowed it to format, just partition.

I want to get the data off either disk - he did his linux backups onto
the windows box. Don't care about windows data.

I think the linux disk is more recoverable. I might be wrong. The
Windows disk has lost its structure (was FAT32, then got munged and then
made FAT32 again)

Anyone have any suggestions for me?

I have tried:

1. captured the disk image using dd to another box after booting with
trinux (cd drive was flakey as well). Doing all the work on the 30GB
disk image

2. used gpart to see if I could determine the original partition table.
It seems to think the one we've got is just fine. Tried deleting the
partition table (after saving with sfdisk) and then running gpart, same
thing - got the 'new' partition table. Can't run testdisk against the
image and when I tried it against the original it reported the same new
partitions.

3. may be new partitions but the ext2 file system isn't there since I
can't mount those new partitions (invalid superblock  etc etc )

4. autopsy and sleuthkit seem to want a file system if they're going to
give me files. I don't have a file system

5. I can work my way through the image with hexedit and strings and such
- the data or much of it is there, but I can't deal with it as
structure.

There are lots of files there, and it would be nice to recover some/all
of them. My only option now seems to be to work though the disk block by
blokc, look for things that look like they might be inodes and follow
the structure.

Is that all I've got left to try??? And is there an 'easy' way to do it?

This is all quite fun but the user is a bit panicky about his data.

Thanks

Brendan.