1

I have an external 1.5TB hard-drive which I've been using for years, no back-ups.

I have several partitions on that hard-drive, one of which has all my data on (I cannot remember whether FAT32/NTFS), and another bootable partition.

I attempted to install UbuntuStudio via Startup Disk Creator, I incorrectly assumed it would only write to the mounted bootable partition. Once I realised my mistake I clicked cancel, Startup Disk Creator crashed and I killed the program.

Now all of my partitions bar the 'UbuntuStudio' created partition have disappeared. The operation only lasted a second, I am hoping my data is recoverable.

I followed: Recover 1TB disk erased with startup disk creator, which showed a list of partitions not able to be recovered, and some which could be. From the partitions of which I could list files, none were my data partition. There were two partitions of identical size (about 200GB) which I could not list the files of. I know the 'label'/name of my data partition, if only I could search for it.

I'm on the verge of despair here, bar committing a crime - I'm sure the Police would have no trouble recovering my data - I don't know what to do. To whoever helps, I owe my sanity to you.

Note: I would post my logs, but I made a further mistake of closing testdisk - the operation took about 12 hours.

GParted screenshot

To my knowledge my HDD is not 5.45 TiB, it is ~1.5 TB.

Any method which repairs the partition records in place is ideal, I do not have a separate external HDD for backing up my files.

Update: this is what I see:

Testdisk output 1

Update:

Testdisk output 2

Scan has finished, I would like to attempt to Add Partition using data from the screenshots, can someone please confirm my actions?

I do not have an external HDD and am attempting repair in-place, with testdisk if possible. Searching for 'testdisk add partition' is returning few relevant results, e. g., https://ubuntuforums.org/archive/index.php/t-797449.html

I am trying to get specific advice about recovering the partition layout, or recreating it if it's corrupt beyond repair.

Community
  • 1
Vix
  • 61
  • @AndreaLazzarotto - Thanks for that link. RecuperaBit sounds promising, though I'm limited by lack of an alternative large storage device. I'm looking for a solution which repairs the partition structure in-place, if possible. – Vix Nov 28 '16 at 14:32
  • That is not possible and you probably don't want to gamble with your data anyway. – Andrea Lazzarotto Nov 28 '16 at 16:07
  • To my knowledge, using teskdisk won't jeopardise my data. Once the scan finishes, I'll upload the results. Backing up my HDD/using RecuperaBit requires buying a new HDD, with money I don't have. But I'd rather that than total my data. – Vix Nov 28 '16 at 16:35
  • How is Testdisk supposed to access the first partition if parts of the MFT have been overwritten? You might be super lucky and it might not be overwritten at all, but that's extremely unlikely. – Andrea Lazzarotto Nov 28 '16 at 20:17
  • I've no experience of testdisk prior to this, or what it's purpose is - I'm an Ubuntu simpleton following instructions. Please see the photo I've attached, it looks as though it can find the large partition which my data is on, but says it can't be recovered. – Vix Nov 28 '16 at 20:36
  • «but says it can't be recovered» Then the MFT is broken. You can use RecuperaBit (or also other programs) to scan the drive directly, but you will need another drive to recover the data. – Andrea Lazzarotto Nov 28 '16 at 21:53
  • From: https://forum.cgsecurity.org/phpBB3/viewtopic.php?p=7831&sid=7b460956f5fa7795870dde46b2bee93c#p7831 how about: http://www.cgsecurity.org/wiki/Advanced_Find_ext2_ext3_Backup_SuperBlock? – Vix Nov 29 '16 at 01:24
  • Those links are about EXT4. – Andrea Lazzarotto Nov 29 '16 at 10:58
  • @AndreaLazzarotto Please remove the 'duplicate' mark against this question. I am about to attempt to 'Add Partition' and am looking for guidance to ensure I get it right. – Vix Nov 29 '16 at 18:52
  • Let us continue this discussion in chat. – Andrea Lazzarotto Nov 29 '16 at 18:58
  • I have sent you a message in the chat. I'm sure I won't be the only one in this predicament, of not having an external HDD, and wanting to attempt a repair of the partition structure. How might I unlock this - having shown the difference between my question and the "duplicate"? – Vix Nov 29 '16 at 23:30
  • BTW are you using Elementary OS to perform the recovery? – Andrea Lazzarotto Nov 30 '16 at 00:10
  • I am, good spot. All I care about is the data on that 730 GB partition, if I can write a new MFT from scratch to allocate that one partition, I should be okay. – Vix Nov 30 '16 at 01:02
  • You cannot just write "a new MFT", that would equate to formatting. Regarding Elementary OS, you risk getting your Q closed as off-topic because it's not about Ubuntu. I won't flag it but it won't take long before someone else notices. If you care about the data, borrow a hard drive from a friend, copy the recovered files there, then format your drive and copy them back. – Andrea Lazzarotto Nov 30 '16 at 01:58
  • Okay, I'm going to leave this question as it stands for now. I am awaiting to hear whether the 'Add Partition' option in testdisk offers any hope, as this part of my question has not been answered. Elementary OS is Ubuntu 16.10, using Ubuntu Software, it's Ubuntu. – Vix Nov 30 '16 at 02:43
  • "whether the 'Add Partition' option in testdisk offers any hope" — It doesn't. As said multiple times, the file system is damaged. Writing a new partition table won't be of any help. – Andrea Lazzarotto Nov 30 '16 at 12:02

1 Answers1

1

It is a good idea to clone the drive with ddrescue as soon as possible, and do the recovery work on the cloned copy. Then you dare test more recovery options. It things go wrong, you can clone it again for more tests.

Install ddrescue with the following command,

sudo apt-get install gddrescue

You find instructions including examples in the info page,

info ddrescue

-o-

I think it is a good idea to continue with testdisk, to try different ways of using it.

If you still have no luck, it is possible to use photorec, also from www.cgsecurity.org/. Photorec will probably recover a lot of your files, but without directory structure and file names, so it is a lot of hard work to identify the recovered files and give them suitable names. It is probably easier to work, if you let photorec search for one file type each time, and take care of those files instead of all files at the same time.

-o-

Gparted is not able to interpret the partition structure of the cloned iso file correctly - this is why the drive size seems to be 4 times bigger than it is.

sudodus
  • 46,324
  • 5
  • 88
  • 152
  • Thank you for your response. I do not have a large enough storage device to clone my disk to. I have been thinking, recover the partitions that I can using testdisk, then -hopefully- the unallocated space left over might be my data partition? – Vix Nov 28 '16 at 13:24
  • There is an option to 'add partition', but I do not know enough to attempt that. I am worried about corrupting my data beyond any damage which may have occurred. – Vix Nov 28 '16 at 13:25
  • 2
    This is why it is good to clone the disk: you dare try methods, without fear of destroying things. (I don't know details about the options of testdisk.) If your data are valuable, you should really try to get such a drive. You could even try to borrow a drive, but if you buy one, it can be used for backup later on :-) – sudodus Nov 28 '16 at 16:48