1

I dun goof'd.

Up until about an hour a I had a working installation of 14.0 on my 2013 Macbook Air, with full disk encryption as set up in the standard installation process.

But tonight, in the process of of trying to fix a corrupt SD card, I accidentally called "Parted" on /dev/SDA/, and then ran a mklabel on in. Below is a transcript of the damage:

ubuntu@ubuntu:~s sudo parted 
GNU Parted 2.3
Using /dev/sda
welcome to GNU Parted! Type 'help' to view a list of commands.
(parted) mklabel
New disk label type? msdos
warning: Partition(s) on /dev/sda are being used.
Ignore/Cancel? I
warning: The existing disk label on /dev/sdb will be destroyed and 
all data on this disk will be lost. Do you went to continue?
Yes/No? y
Error: Partition(s) 1 on /dev/sda have been written, but we have been 
unable to inform the kernel of the change, probably because it/they 
are in use. As a result, the old partition(s) will remain in use. You 
should reboot now before making further changes.
lgnore/cancel? c
(parted) 

Lo and behold upon rebooting, I'm greeted with a flashing folder questionmark - which I think is Mac-speak for "I can't find a boot/system partition". I've got a liveboot Ubuntu USB and can get it to start off that, but when I look at the main SSD in disk utility it just sees 250gb of free space.

Yep, I'm a muppet, no argument there. But at least I know when to stop and get help fromthose who know better. I could try out random stuff from Google, but I really do't know quite what Im doing and I dontwant to make this worse. I worry my encryption might complicate things.

Any guidance on how to find out just what damage I've done and how to recover it?

  • Thanks but I don't think they are the same. That guy did a full installation of a new copy of Ubuntu in that question. I didn't write overwrite anything with any new data - I just wiped the disk label ...whatever that means. Or maybe Im just not understanding the mechanics of what I'm dealing with here? I'm still not exactly sure what "mklabel" actually re-writes. –  Aug 03 '15 at 09:00
  • Thanks again but I really don't know if this is the same ...that guy also created a new partition, which I didn't. Or is making a new disk label the same as making a new partition?? If these ARE the same as my situation, could anyone elaborate on why/how? I'm not overly familiar with this stuff. Thanks :) –  Aug 03 '15 at 10:32
  • 1
    You're focusing too much on the unimportant differences between your case and the suggested duplicates. In all three cases, the best hope of recovery is to run TestDisk, and the suggested duplicate answers describe how to do that. – Rod Smith Aug 03 '15 at 12:59
  • Okay seriously, I've spent a MONTH trying to fix this, is ANYONE able to offer some actual advice here? The alleged 'duplicates' like is said from the start are all different situations. Ive tried using TestDisk but the 'tutorial' makes no sense and bears no semblance to what I get on my screen, and everything else on this site is just a circle-jerk of people marking everything as duplicates of duplicates and no-one actually answering anything. Seriously, can anyone please help me out here?? –  Sep 17 '15 at 12:40
  • If this really IS a problem with common elements, could someone please EXPLAIN the how, and how I can adapt the other solutions to work for my problem? Maybe its all obvious to you lot, but I'm not an expert, and I seriously can't make sense of this. –  Sep 17 '15 at 13:21
  • 1
    @RodSmith Looks like the OP might need a bit more help than that.. Are you sure the other questions will help restore a overwritten label? If so, it might be a good idea to detail exactly how on this post.. – Seth Sep 18 '15 at 00:56
  • 1
    @Seth ah, mklabel creates a new partition table. Unfortunate name, but yes, given a lost partition table, the best option is testdisk. – muru Sep 18 '15 at 01:04
  • 1
    @muru That's good to know, but given previous comments by the OP it would seem he could use some help figuring out how to use it for his situation. – Seth Sep 18 '15 at 01:17
  • Wow, thanks guys that's the most help so far. So re writing the disk label does indeed wipe the partition table? I am trying to run testdisk now and it seems to have found some stuff (like my boot partition) but I don't really understand it...how do I restore a partition table with test disk? –  Sep 18 '15 at 02:12
  • Oh also can I upload pictures here?maybe I can put up some of the testdisk output and someone can tell me what it means? –  Sep 18 '15 at 02:13
  • jdeks, please read the TestDisk documentation. That should answer most of your questions. If you need more help after that point, you'll at least be able to ask a more specific question with (hopefully) a narrow answer. – Rod Smith Sep 18 '15 at 12:49
  • @RodSmith I said already, I have tried. Its huge, its highly technical, I don't understand it, and MY COMPUTER DOESNT WORK. I've been chasing 'help' guides for 4,weeks now, they DONT answer my questions, or tell me how to interpret what I'm seeing, or what they do. They're all written like you're expected to already know the answer from the start. I'm tired of being fobbed off with throw away one-line "use xyz" answers and being treated like an idiot because I'm not a programmer or something. That's really the opposite of help. –  Sep 18 '15 at 15:32
  • @RodSmith I don't know how I could ask any narrower a question than the one I already have. There's literally no more detail I can give. I changed the disk label by accident. I want to change it back, without spending the rest of my life reading obscure wiki pages. Im not askimg for.people to just fix it for me, just some clear instruction in plain language. Why are people being so coy about this? –  Sep 18 '15 at 15:40
  • We aren't being coy. We *CANNOT* provide step-by-step instructions to answer every detail of what you're seeing with the tools you're using because those details vary from one situation to another. If you find the instructions confusing, then ask specific questions about what specifically you find confusing. At this point, your best option may be to hand the disk over to a paid data-recovery service, but that will be expensive. Failing that, posting on a more interactive forum than this one may be in order; this forum isn't set up for extended back-and-forth discussions. – Rod Smith Sep 19 '15 at 19:45

1 Answers1

1

Well, in the end, someone else on another forum DID take a few minutes moment to walk me through Testdisk, have a look at what I got, and explain how to interpret it and what the next step should be.

In the end, it wasn't just a case of "Use Testdisk".

Found this:

http://ubuntuforums.org/showthread.php?t=895224 (oddly enough, no-one helped this guy out either...)

Long story short, even if you nuke your partiton table with mklabel, the data IS stil there, and if you can find out the sectors where the partitions used to be, you CAN put a new partition table in place and it will let you access the data.

So I gave gdisk a go, because apparently it's supposed to be able to restore backup GPT table....except it didn't. No idea why, but despite apparently finding a backup table, restoring it did nothing.

Then by sheer luck I found this:

http://ubuntuforums.org/showthread.php?t=2214497 (also another person who had to "bite the bullet" and go for it without advice...)

Again, summarizing -

Despite what it says (or rather, doesn't say) on its documentation Testdisk for whatever reason can't restore full LUKS partitions. In fact it cant even find them!! But - you can at least use it to get some ideas on what sector the LUKS partition might have started - it at least picks up the LUKS header as a 4096 / 2MB partition.

You can then take the starting sector of this header and make a new partition manually from there to the end sector of the disk (assuming you encrypted all the remaining disk - if you don't know the end sector you're in trouble, testdisk can't find it. But if you get it right and write a new partitions table with those sectors, viola - you have a mountable partition and can recover your data. If you can find the sectors you can restore the EFI and boot partitions too (test disk at least can do this itself, it picks up the FAT and efs2).

However no matter what flags I put on them, it still wouldn't boot.So instead, I dd'd each of these recovered partitions separately onto an external drive, re-installed a a fresh encrypted copy of ubuntu, then dd'd the recovered partitions back into their respective places. The partiton sizes are all identical and it all booted up like nothing had ever changed, even swap worked.

So, what have I learned? Well, if you fry your partition table, even with an encrypted install, the data IS recoverable.

And motorbike forums provide apparently provide more tech help in an afternoon than the actual Ubuntu support sites provide in a month... :/

And folks wonder why people won't use Linux...