Puppy Linux Discussion Forum Forum Index Puppy Linux Discussion Forum
Puppy HOME page : puppylinux.com
"THE" alternative forum : puppylinux.info
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

The time now is Thu 27 Nov 2014, 01:46
All times are UTC - 4
 Forum index » House Training » Beginners Help ( Start Here)
How to recover deleted partitions?
Moderators: Flash, Ian, JohnMurga
Post_new_topic   Reply_to_topic View_previous_topic :: View_next_topic
Page 1 of 1 Posts_count  
Author Message
tasmod


Joined: 04 Dec 2008
Posts: 1462
Location: North Lincolnshire. UK

PostPosted: Wed 04 Apr 2012, 08:14    Post_subject:  How to recover deleted partitions?  

I'm lost here after a couple of baffling moves.

My original setup had 8 partitions up to sda8. sda1 was my boot partition containing my save files etc for my various iso's.

I wanted to delete a partition so opened gparted.

I selected sda5 to delete and confirmed before carrying out the operation.
This is where things got peculiar, it deleted sda8 my main work partition containing all my programming work !

I checked the menu and there were no options to undo action. The mere fact it deleted sda8 had me worried.

Before i went any further I decided to use testdisk and recover the partition. Allegedly very straightforward.

I ran testdisk and it found the partition, oh joy, so I selected the recover option. Then the real weirdness started, it deleted sda7 instead and changed my boot partition sda1 to a ntfs partition !!

So here i stand, loaded a live cd of luci 529 as it won't boot from hd and ran gparted to see what it shows.

Here goes:-

sda1 boot ntfs (?)
sda2 extended

sda5 ext2
sda6 ext2

unallocated 9.09gb (was sda7)
unallocated 12.6gb (was sda8)


I don't want to go any further without guidance as to how to get back to the original setup and recover the data.

_________________
Rob
-
The moment after you press "Post" is the moment you actually see the typso Cool
Back to top
View user's profile Send_private_message Visit_website 
rcrsn51


Joined: 05 Sep 2006
Posts: 9260
Location: Stratford, Ontario

PostPosted: Wed 04 Apr 2012, 08:25    Post_subject:  

Quote:
I don't want to go any further without guidance as to how to get back to the original setup and recover the data.

The most obvious suggestion would be to restore from your backup images of these partitions. But you probably don't want to hear that Wink
Back to top
View user's profile Send_private_message 
tasmod


Joined: 04 Dec 2008
Posts: 1462
Location: North Lincolnshire. UK

PostPosted: Wed 04 Apr 2012, 08:40    Post_subject:  

True, I don't want to hear it. We all mean to backup but never do thoroughly. Sad
_________________
Rob
-
The moment after you press "Post" is the moment you actually see the typso Cool
Back to top
View user's profile Send_private_message Visit_website 
Peterm321

Joined: 29 Jan 2009
Posts: 241

PostPosted: Wed 04 Apr 2012, 09:44    Post_subject:  

I once used testdisk to undelete a partition on a removable usb drive, and it worked fine.

You can find videos re: testdisk on youtube, search for testdisk partition recovery.

This link, http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step demonstrates with screendumps the use of testdisk, including highlighting a deleted partition and typing p to list its files.

You can type fdisk -l (letter l not the number 1) in a terminal window and it gives a second opinion on what partitions your system sees.
Back to top
View user's profile Send_private_message 
Sylvander

Joined: 15 Dec 2008
Posts: 3518
Location: West Lothian, Scotland, UK

PostPosted: Wed 04 Apr 2012, 10:50    Post_subject:  

1. See:
Recover deleted partitions using Testdisk in Ubuntu #11

About 2/3 of the way through, he mentions "Deeper search".
You will probably need to do this to find your original deleted partition.
Here's hoping the "Deeper search" finds [or does it reconstruct?] your deleted partition. Very Happy

Beware! I'm no super expert. Confused
But I did once use testdisk to successfully recover an XP NTFS partition to get XP booting again. Very Happy

2. It would be wise to clone the HDD prior to messing with it any further.
And work on the cloned copy?

3. I ALWAYS have various backups = images, Xfe copy of folder/file contents, snap2 folder/file copies...
So that WHEN something goes wrong...
You know they say...
It's not IF, but WHEN it will go wrong. Sad
My reason for spending lots of time at PC forums, was to...
Learn from the mistakes made by others...
NOT from my own mistakes.
Back to top
View user's profile Send_private_message 
tasmod


Joined: 04 Dec 2008
Posts: 1462
Location: North Lincolnshire. UK

PostPosted: Wed 04 Apr 2012, 11:53    Post_subject:  

I still can't understand why both programs did what they did. I was most careful.

Anyway, testdisk deep scan found my work partition and restored it. However my Puppy iso's and savefiles were nowhere to be found. It did find very, very old Windows files Confused

I also realised it had removed the extended partition sda4 which testdisk found and restored.

The linux swap and my music partition are gone and nowhere to be found either. Neither testdisk or photorec found them.

I made a new swap and the music is no hardship as I have it all on usb stick.

I have still got unallocated space which needs sorting but other than that I can resume again. I changed the newly created ntfs partition size but kept it for a windows install later.

_________________
Rob
-
The moment after you press "Post" is the moment you actually see the typso Cool
Back to top
View user's profile Send_private_message Visit_website 
Jasper


Joined: 25 Apr 2010
Posts: 1163
Location: England

PostPosted: Wed 04 Apr 2012, 12:16    Post_subject:  

Hi tasmod,

I'm delighted to read your system is pretty much back to normal.

My regards and thanks for all your help
Back to top
View user's profile Send_private_message 
Sylvander

Joined: 15 Dec 2008
Posts: 3518
Location: West Lothian, Scotland, UK

PostPosted: Wed 04 Apr 2012, 15:50    Post_subject:  

tasmod wrote:
my Puppy iso's and savefiles were nowhere to be found...The linux swap and my music partition are gone and nowhere to be found either. Neither testdisk or photorec found them.

Methinks they were overwritten during the original "weirdness".
I'd like to understand how TestDisk and PhotoRec do what they do.
If anyone knows, could they explain?
Back to top
View user's profile Send_private_message 
capicoso

Joined: 13 Jan 2012
Posts: 172
Location: Argentina

PostPosted: Wed 04 Apr 2012, 19:10    Post_subject:  

Sylvander wrote:
tasmod wrote:
my Puppy iso's and savefiles were nowhere to be found...The linux swap and my music partition are gone and nowhere to be found either. Neither testdisk or photorec found them.

Methinks they were overwritten during the original "weirdness".
I'd like to understand how TestDisk and PhotoRec do what they do.
If anyone knows, could they explain?

AFAIK the HDD always has a backup of the last partition table. So it just recovers it.
Also, when a partition or hdd gets formatted, all you're doing is rewriting that part of the table, the files are still there, but they aren't in the table, so they can't be accessed. Photorec and/or any other recover program just recovers the data that's still floating there without any instruction. When you start using that formatted disk, you're writing new data into the old data. So if you formatted a disk, then used 50% of it, you'll be able to recover the other 50% left.
Back to top
View user's profile Send_private_message 
bigpup


Joined: 11 Oct 2009
Posts: 5390
Location: Charleston S.C. USA

PostPosted: Thu 05 Apr 2012, 00:07    Post_subject:  

I suggest getting the latest live CD version of Gparted and using it to do any heavy changes. It is a live CD that is specifically made to run Gparted. The kernel is tweaked, to support Gparted functions, it is the latest version of Gparted, and required programs are updated. Has TestDisk and other recovery programs.
http://sourceforge.net/projects/gparted/files/gparted-live-stable/0.12.0-5/

_________________
I have found, in trying to help people, that the things they do not tell you, are usually the clue to solving the problem.
When I was a kid I wanted to be older.... This is not what I expected Shocked
Back to top
View user's profile Send_private_message 
Burn_IT


Joined: 12 Aug 2006
Posts: 1078
Location: Tamworth UK

PostPosted: Thu 05 Apr 2012, 11:49    Post_subject:  

There is a second copy of the tables held at the end of the disk, which is why you cannot ever use the last few sectors.

Also every partition (the actual data not the table entries) always starts with a specific sequence of bytes - which are unlikely to occur at random - so Testdisk etc. just scan for those bytes, and a few bytes further on is the length of the partition.

_________________
I can't remember the last time I forgot something!
Back to top
View user's profile Send_private_message 
Karl Godt


Joined: 20 Jun 2010
Posts: 3972
Location: Kiel,Germany

PostPosted: Thu 19 Apr 2012, 16:49    Post_subject:  

I want to add that i had similar issues having a HDD attached by USB to the machine . Apparently the fittings had not been tight and the connection seems to have gone lost for a very short moment from under one second . I was writing to a file on a NTfs partition that time with the echo command . The drive icons suddenly dissapeared , just the mounted partition had been accessible .. the partitions were still listed in /proc/partitions and the nodes were still in /dev/ directory, but fdisk -l did not list the drive anymore ..
It seems that NTFS support in Puppy 4.3 until 5.1.1 had been better than nowerdays, I suspect the ntfs-3g binary/libs .
(that had been on Racy-5.3 and Saluki-19)

First i booted win7 to run chkdsk where the drive suddenly dissapeared again .
I attached that to another machine, and ran ntfsfix from Puppy 4.3 and all was fine . The file i wrote to had gone, but the I/O error was cured i got while tring to mount ISOs and pup.sfs archives on this ntfs partition .
Posssible also, that maybe the drive got a little warm .
smartmontools lists 54°C as max temperature .
Back to top
View user's profile Send_private_message Visit_website 
piteapup


Joined: 13 Aug 2009
Posts: 35
Location: pitea-sweden

PostPosted: Wed 11 Jul 2012, 01:56    Post_subject: photorec
Sub_title: dd commands
 

from what i see photorec uses dd cmd's to find files-i maybe wrong but it seems the best way to do it.heres a interesting link on dd and what you can do with it:-
http://www.linuxquestions.org/questions/linux-newbie-8/learn-the-dd-command-362506/
if anyone would put a pet together for the testdisk6.14 it would be nice(slacko533)
Back to top
View user's profile Send_private_message 
Karl Godt


Joined: 20 Jun 2010
Posts: 3972
Location: Kiel,Germany

PostPosted: Wed 11 Jul 2012, 04:46    Post_subject:  

Quote:
if anyone would put a pet together for the testdisk6.14 it would be nice(slacko533)

failed to compile on my Puppy-4 series with
Quote:
ntfs_dir.c:407: Fehler: too many arguments to function ‘ntfs_mbstoucs’

course the many ntfs-problems in Puppy-5 which seem to be fewer now i fear to upgrade my ntfs-lib-exe environment .

TestDisk & PhotoRec Source code : http://www.cgsecurity.org/wiki/TestDisk_Download
Back to top
View user's profile Send_private_message Visit_website 
Peterm321

Joined: 29 Jan 2009
Posts: 241

PostPosted: Wed 11 Jul 2012, 21:55    Post_subject:  

Karl Godt wrote:
failed to compile on my Puppy-4 series with
Quote:

ntfs_dir.c:407: Fehler: too many arguments to function ‘ntfs_mbstoucs’



When I did a grep search for "ntfs_mbstoucs" in the testdisk directories I found a reference in the ./configure script which is supposed to compile a short test to see if the library routine had two or three arguments to it:

Code:

cat confdefs.h - <<_ACEOF >conftest.$ac_ext
/* end confdefs.h.  */
.....

int
main ()
{
 ntfs_mbstoucs(NULL,NULL);
  ;
  return 0;
}
_ACEOF
if ac_fn_c_try_compile "$LINENO"; then :
  ac_cv_c_ntfs_mbstoucs_have_two_arguments=yes
else
  ac_cv_c_ntfs_mbstoucs_have_two_arguments=no
fi


However I couldnt't find a file called condefs.h or conftest. I assumed, perhaps without doing enough homework, that the #define NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS statement that should be somewhere in the source code remains undefined globally. Particularly it remained undefined when trying to compile the file testdisk-6.14-WIP/src/ntfs_dir.c It appeared it should be defined and that this means ntfs_mbstoucs() takes two arguments?

Anyway I added this just before line 405 in src/ntfs_dir.c :

Code:

#define  NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS 1


So the section of code looks like (with line numbers included for clarity):

Code:

404 #define  NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS 1
405 #ifdef NTFS_MBSTOUCS_HAVE_TWO_ARGUMENTS
406      const int len=ntfs_mbstoucs(stream_name, &stream_name_ucs);
407 #else
408      const int len=ntfs_mbstoucs(stream_name, &stream_name_ucs, 0);
409 #endif


I was able to continue the compile (wary 5.0) with lots of warnings but the executables were still created and appear OK. FYI I ran testdisk briefly and was able to undelete on a vfat partition but cant vouch for the safety of my tampering with the source code particularly with regard to its effect on the ntfs related testdisk operations. NB I am not a testdisk expert.
Back to top
View user's profile Send_private_message 
Display_posts:   Sort by:   
Page 1 of 1 Posts_count  
Post_new_topic   Reply_to_topic View_previous_topic :: View_next_topic
 Forum index » House Training » Beginners Help ( Start Here)
Jump to:  

Rules_post_cannot
Rules_reply_cannot
Rules_edit_cannot
Rules_delete_cannot
Rules_vote_cannot
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group
[ Time: 0.0967s ][ Queries: 11 (0.0033s) ][ GZIP on ]