How to recover deleted partitions?

[tasmod]

I'm lost here after a couple of baffling moves.

My original setup had 8 partitions up to sda8. sda1 was my boot partition containing my save files etc for my various iso's.

I wanted to delete a partition so opened gparted.

I selected sda5 to delete and confirmed before carrying out the operation.
This is where things got peculiar, it deleted sda8 my main work partition containing all my programming work !

I checked the menu and there were no options to undo action. The mere fact it deleted sda8 had me worried.

Before i went any further I decided to use testdisk and recover the partition. Allegedly very straightforward.

I ran testdisk and it found the partition, oh joy, so I selected the recover option. Then the real weirdness started, it deleted sda7 instead and changed my boot partition sda1 to a ntfs partition !!

So here i stand, loaded a live cd of luci 529 as it won't boot from hd and ran gparted to see what it shows.

Here goes:-

sda1 boot ntfs (?)
sda2 extended

sda5 ext2
sda6 ext2

unallocated 9.09gb (was sda7)
unallocated 12.6gb (was sda8)


I don't want to go any further without guidance as to how to get back to the original setup and recover the data.

[rcrsn51]

I don't want to go any further without guidance as to how to get back to the original setup and recover the data.

The most obvious suggestion would be to restore from your backup images of these partitions. But you probably don't want to hear that

[tasmod]

True, I don't want to hear it. We all mean to backup but never do thoroughly.

[Peterm321]

I once used testdisk to undelete a partition on a removable usb drive, and it worked fine.

You can find videos re: testdisk on youtube, search for testdisk partition recovery.

This link, http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step demonstrates with screendumps the use of testdisk, including highlighting a deleted partition and typing p to list its files.

You can type fdisk -l (letter l not the number 1) in a terminal window and it gives a second opinion on what partitions your system sees.

[Sylvander]

1. See:
Recover deleted partitions using Testdisk in Ubuntu #11

About 2/3 of the way through, he mentions "Deeper search".
You will probably need to do this to find your original deleted partition.
Here's hoping the "Deeper search" finds [or does it reconstruct?] your deleted partition.

Beware! I'm no super expert.
But I did once use testdisk to successfully recover an XP NTFS partition to get XP booting again.

2. It would be wise to clone the HDD prior to messing with it any further.
And work on the cloned copy?

3. I ALWAYS have various backups = images, Xfe copy of folder/file contents, snap2 folder/file copies...
So that WHEN something goes wrong...
You know they say...
It's not IF, but WHEN it will go wrong.
My reason for spending lots of time at PC forums, was to...
Learn from the mistakes made by others...
NOT from my own mistakes.

[tasmod]

I still can't understand why both programs did what they did. I was most careful.

Anyway, testdisk deep scan found my work partition and restored it. However my Puppy iso's and savefiles were nowhere to be found. It did find very, very old Windows files

I also realised it had removed the extended partition sda4 which testdisk found and restored.

The linux swap and my music partition are gone and nowhere to be found either. Neither testdisk or photorec found them.

I made a new swap and the music is no hardship as I have it all on usb stick.

I have still got unallocated space which needs sorting but other than that I can resume again. I changed the newly created ntfs partition size but kept it for a windows install later.

[Jasper]

Hi tasmod,

I'm delighted to read your system is pretty much back to normal.

My regards and thanks for all your help

[Sylvander]

my Puppy iso's and savefiles were nowhere to be found...The linux swap and my music partition are gone and nowhere to be found either. Neither testdisk or photorec found them.

Methinks they were overwritten during the original "weirdness".
I'd like to understand how TestDisk and PhotoRec do what they do.
If anyone knows, could they explain?

[capicoso]

my Puppy iso's and savefiles were nowhere to be found...The linux swap and my music partition are gone and nowhere to be found either. Neither testdisk or photorec found them.

Methinks they were overwritten during the original "weirdness".
I'd like to understand how TestDisk and PhotoRec do what they do.
If anyone knows, could they explain?

AFAIK the HDD always has a backup of the last partition table. So it just recovers it.
Also, when a partition or hdd gets formatted, all you're doing is rewriting that part of the table, the files are still there, but they aren't in the table, so they can't be accessed. Photorec and/or any other recover program just recovers the data that's still floating there without any instruction. When you start using that formatted disk, you're writing new data into the old data. So if you formatted a disk, then used 50% of it, you'll be able to recover the other 50% left.

[bigpup]

I suggest getting the latest live CD version of Gparted and using it to do any heavy changes. It is a live CD that is specifically made to run Gparted. The kernel is tweaked, to support Gparted functions, it is the latest version of Gparted, and required programs are updated. Has TestDisk and other recovery programs.
http://sourceforge.net/projects/gparted ... /0.12.0-5/

[Burn_IT]

There is a second copy of the tables held at the end of the disk, which is why you cannot ever use the last few sectors.

Also every partition (the actual data not the table entries) always starts with a specific sequence of bytes - which are unlikely to occur at random - so Testdisk etc. just scan for those bytes, and a few bytes further on is the length of the partition.

[Karl Godt]

I want to add that i had similar issues having a HDD attached by USB to the machine . Apparently the fittings had not been tight and the connection seems to have gone lost for a very short moment from under one second . I was writing to a file on a NTfs partition that time with the echo command . The drive icons suddenly dissapeared , just the mounted partition had been accessible .. the partitions were still listed in /proc/partitions and the nodes were still in /dev/ directory, but fdisk -l did not list the drive anymore ..
It seems that NTFS support in Puppy 4.3 until 5.1.1 had been better than nowerdays, I suspect the ntfs-3g binary/libs .
(that had been on Racy-5.3 and Saluki-19)

First i booted win7 to run chkdsk where the drive suddenly dissapeared again .
I attached that to another machine, and ran ntfsfix from Puppy 4.3 and all was fine . The file i wrote to had gone, but the I/O error was cured i got while tring to mount ISOs and pup.sfs archives on this ntfs partition .
Posssible also, that maybe the drive got a little warm .
smartmontools lists 54°C as max temperature .

[piteapup]

from what i see photorec uses dd cmd's to find files-i maybe wrong but it seems the best way to do it.heres a interesting link on dd and what you can do with it:-
http://www.linuxquestions.org/questions ... nd-362506/
if anyone would put a pet together for the testdisk6.14 it would be nice(slacko533)

[Karl Godt]

if anyone would put a pet together for the testdisk6.14 it would be nice(slacko533)

failed to compile on my Puppy-4 series with

ntfs_dir.c:407: Fehler: too many arguments to function ‘ntfs_mbstoucs’

course the many ntfs-problems in Puppy-5 which seem to be fewer now i fear to upgrade my ntfs-lib-exe environment .

TestDisk & PhotoRec Source code : http://www.cgsecurity.org/wiki/TestDisk_Download

[Peterm321]

failed to compile on my Puppy-4 series with

ntfs_dir.c:407: Fehler: too many arguments to function ‘ntfs_mbstoucs’

When I did a grep search for "ntfs_mbstoucs" in the testdisk directories I found a reference in the ./configure script which is supposed to compile a short test to see if the library routine had two or three arguments to it:

Code: Select all

cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h.  */
.....

int
main ()
{
 ntfs_mbstoucs(NULL,NULL);
  ;
  return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
  ac_cv_c_ntfs_mbstoucs_have_two_arguments=yes
else
  ac_cv_c_ntfs_mbstoucs_have_two_arguments=no
fi

However I couldnt't find a file called condefs.h or conftest. I assumed, perhaps without doing enough homework, that the #define NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS statement that should be somewhere in the source code remains undefined globally. Particularly it remained undefined when trying to compile the file testdisk-6.14-WIP/src/ntfs_dir.c It appeared it should be defined and that this means ntfs_mbstoucs() takes two arguments?

Anyway I added this just before line 405 in src/ntfs_dir.c :

Code: Select all

#define  NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS 1

So the section of code looks like (with line numbers included for clarity):

Code: Select all

404 #define  NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS 1
405 #ifdef NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS
406      const int len=ntfs_mbstoucs(stream_name, &stream_name_ucs);
407 #else
408      const int len=ntfs_mbstoucs(stream_name, &stream_name_ucs, 0);
409 #endif

I was able to continue the compile (wary 5.0) with lots of warnings but the executables were still created and appear OK. FYI I ran testdisk briefly and was able to undelete on a vfat partition but cant vouch for the safety of my tampering with the source code particularly with regard to its effect on the ntfs related testdisk operations. NB I am not a testdisk expert.

[Burn_IT]

Quick?? Reply to a 5 year old thread??

[musher0]

Yeah, five years later...

TestDisk and PhotoRec still exist:
https://www.cgsecurity.org

They now have unzip-and-go versions,

No need to compile them.
(You probaby couldn't, too, if your HD is kaput.)

BFN.

[Mike Walsh]

At a guess, I would say that the reason why sda8 got deleted is quite simple.

Sda5, by its very nomenclature, would be a logical partition inside an extended partition. On the occasions when I've wanted to do this sort of thing, if I was to use gParted to try and delete sda5 in my current setup, it would insist on my deleting sda6, sda7, sda8, sda9, sda10, and sda11 first before deleting the one I wanted to get shot of.

Primary partitions will delete in any order. Logical partitions, anything higher has to be removed first. That's just the way gParted works. If I want to re-use a logical partition, I simply re-format it; that way, the partition itself remains, and doesn't upset the existing disk structure.

At least, that's my understanding of the process. Feel free to correct me if I'm wrong.....


Mike.