2

I used GParted to convert a primary partition to extended one after copying the data to another partition. After having the extended partition I moved the data back. To my utter shock after a restart I found out that the new extended partition did convert into "unallocated space". I tried installing testdisk. Testdisk could identify the partition as a primary partition and not the newly created extended partition. So what should I do now? I badly want the data back.

Dan B
  • 21
Chethan S.
  • 2,864

3 Answers3

4

It's rather difficult to solve such problems via the internet, and it certainly doesn't fit the question -> answer nature of askubuntu.com.

Anyways:

  • Whenever such things happen, immediately shutdown the system and don't write (or install) anything to it!

  • Start a live CD, download the 6.12-WIP version of TestDisk (you just need to unpack it, then start it with sudo ./testdisk), let it search for partitions, examine the contents of the found partitions, and if you are 100% sure that you've found the right partition, restore it.

  • You can find a couple of detailed examples in the TestDisk wiki (e.g., TestDisk step-by-step).

If you don't feel comfortable doing it yourself, ask someone that has experience with this tool to do it for you. Any mistake can lead to permanent loss of data!

htorque
  • 64,798
2

If you got easily recognizable data on your partition (pictures, documents, file archives etc) I would recommend you trying out foremost, it has helped me out a few times.

Also, check out DataRecovery.

Dan B
  • 21
2

Unless someone is willing to spend a lot of time explaining the process in detail, you're best bet will be researching this yourself online. Here's an excellent lifehacker article which guides you a process very similar to the position you're in.

I've used the tools outlined in that article myself and while it takes a bit of reading to get started, it's not particularly complicated and I got good results.

There used to be a good WIKI page on wiki.ubuntu.com regarding disk forensics, but I can't seem to find it anymore. I'll post it if I can find it.

Scaine
  • 11,139
  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Imagine the linked site goes down for maintenance or forever - your answer would become worthless. – nanofarad Aug 02 '12 at 13:19
  • Not something I'm interested in doing to an answer I provided nearly 18 months ago to a guy desperate for data back same day. And as my answer clearly stated, a full expose of the article's relevant points would fill pages. When the question is time-sensitive or vague this canned request makes no sense. – Scaine Aug 03 '12 at 08:46