ext4 filesystem seen as ms data (ntfs) filesystem.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Post Reply
Message
Author
epiqpwnage
Posts: 1
Joined: 15 Sep 2021, 19:16

ext4 filesystem seen as ms data (ntfs) filesystem.

#1 Post by epiqpwnage »

I have a 6TB WD Purple that is formatted as ext4 (GPT). I used it as in a 5 slot external hdd usb dock for RASPBIAN OS on raspberry pi plex server.
I was copying files from another external hdd (ntfs) to the 6TB drive when the electricity went out.
When I restarted the raspberry PI, all the other 4 external hdds (all were NTFS) were mounted with no issues, except for the 6TB ext4.
It seems the filesystem was corrupted. I tried fsck/e2fsck to try and repair, but I get "Bad magic number in super-block while trying to open /dev/sde1" errors. Tried e2fsck -b to change repair it using the other superblock backups to no avail.

So I checked out test disk. Using testdisk on the raspbian os, the drives sizes were not reported. So I connected the HDD dock to my laptop with POP OS (Ubuntu), and the drive sizes were reported correctly so I proceeded.

I tried the filesystem repair. The partition is seen as Linux filesys. data.
Selected ext4. But I get the Can't open filesystem. Filesystem seems damaged error.

I tried the Parition recovery. Did a quicksearch (did not finish) Because the partition Linux filesys. data appeared.
After I stopped it, I chose MS Data and can see all my files and folders. Tried copying some of the folders/files to my other external hdd and it was copied successfully preserving the filename and folder structure.

My questions are, why did Testdisk see this as an MS Data partition?
Testdisk says the partitions found cannot be recovered, does it mean if I tried to write the partition, I will not be able to mount it unless I reformat it or rewrite the filesystem using mkefs?
The only solution is to copy the data and reformat the 6TB?
Will finishing the quick search change anything?
Is it safe to write the partition table as MS Data?

Below is the testdisk.log for the part when I did a quicksearch and aborted. Thanks.
Disk /dev/sde - 6001 GB / 5589 GiB - CHS 5723166 64 32
recover_EXT2: s_block_group_nr=0/123447, s_mnt_count=1/4294967295, s_blocks_per>
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 4045132288
recover_EXT2: part_size 32361058304
Filesystem created: Tue Mar 9 21:22:23 2021
Last mount time: Tue Mar 9 22:18:09 2021
Linux filesys. data 681 32361058984 32361058304
ext4 blocksize=4096 Large_file Sparse_SB, 16 TB / 15 TiB
This partition ends after the disk limits. (start=681, size=32361058304, end=32>
NTFS at 5723165/63/32
heads/cylinder 255 (NTFS) != 64 (HD)
sect/track 63 (NTFS) != 32 (HD)
filesystem size 11721041920
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2
clusters_per_mft_record -10
clusters_per_index_record 1
MS Data 2048 11721043967 11721041920 [media6tb]
NTFS found using backup sector, blocksize=4096, 6001 GB / 5589 GiB
Search for partition aborted
Disk /dev/sde - 6001 GB / 5589 GiB - CHS 5723166 64 32
Check the harddisk size: HD jumper settings, BIOS detection...
The harddisk (6001 GB / 5589 GiB) seems too small! (< 16 TB / 15 TiB)
The following partitions can't be recovered:
Linux filesys. data 681 32361058984 32361058304
ext4 blocksize=4096 Large_file Sparse_SB, 16 TB / 15 TiB
MS Data 11721043967 23442085886 11721041920
NTFS, blocksize=4096, 6001 GB / 5589 GiB

Results
P MS Data 2048 11721043967 11721041920 [media6tb]
NTFS found using backup sector, blocksize=4096, 6001 GB / 5589 GiB

Post Reply