I formatted HDD(called "Volume2"). How to recover it?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
harupiyo
Posts: 2
Joined: 01 Dec 2020, 08:51

I formatted HDD(called "Volume2"). How to recover it?

#1 Post by harupiyo »

What happened:
I have an ASUSTOR NAS, AS1002T, with two HDDs (Volume 1, Volume 2) and no RAID set up.
Volume1 had a physical sector failure and bought new HDD and replaced it. (Volume1 HDD is not the focus of this story. Forget it.)

At this stage, there is no damage to Volume2.
In order for the NAS to recognize the new HDD, Volume1, we had to reset the NAS to its factory state and set it up from scratch.
At this stage, the NAS is now able to mount the Volume1, while it no longer recognizes the Volume2 HDD.
The only thing left to do is to make it recognize the Volume2 HDD.
So I opened the Storage Manager menu on the NAS side Web administration screen and applied "Non-RAID Volume Type Single: Create storage space using only a single disk" to Volume2.
At that time, Volume2 seems to have undergone a formatting or partition change operation and I can no longer see any folders or files.

Towards recovery:
I knew from the catalog that the internal disk format of the NAS is ext4.
https://www.asustor.com/product/spec?p_id=42
-> filesystem - internal disk: EXT4

I took Volume2 out of the NAS, connected it to Windows 10 64-bit and started Windows.
I installed TestDisk and specified the disk.

Code: Select all

	TestDisk 7.2-WIP, Data Recovery Utility, Novembre 2020
	Christophe GRENIER <grenier@cgsecurity.org>
	https://www.cgsecurity.org
	Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
	Current partition structure:
	Partition                  Start        End    Size in sectors
	1 P Linux filesys. data         2048     524287     522240
	2 P Linux Raid                524288    4718591    4194304 [AS1002T-8BDC:0]
	3 P Linux Raid               4718592    8912895    4194304 [AS1002T-8BDC:126]
	4 P Linux Raid               8912896 5860532223 5851619328 [AS1002T-8BDC:2]
	P=Primary  D=Deleted 
	>[Quick Search]  [ Backup ]
	Try to locate partition
I did a [Quick Search].
The folder/file is in Partition #4.

Code: Select all

	Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
	Partition               Start        End    Size in sectors
	 P Linux filesys. data         2048     524287     522240
	 P Linux Raid                524288    4714503    4190216 [AS1002T-8BDC:0]
	 P Linux Raid               4718592    8908807    4190216 [AS1002T-8BDC:126]
	>P Linux Raid               8912896 5860270087 5851357192 [AS1002T-8BDC:2]
Note that [P: list files] is not available in Partition #4.
Only Partition #1 is previewable, and its content is as follows: [P: list files].

Code: Select all

	Directory /
	drwxr-xr-x     0     0      1024  1-Dec-2020 13:11 ..
	-rw-r--r--     0     0     15984  1-Dec-2020 12:40 AS10XXT.dtb
	-rw-r--r--     0     0        91  1-Dec-2020 12:40 AS10XXT.dtb.md5sum
	-rw-r--r--     0     0     15984  1-Dec-2020 12:40 AS10XXTE.dtb
	-rw-r--r--     0     0        92  1-Dec-2020 12:40 AS10XXTE.dtb.md5sum
	-rw-r--r--     0     0 124857289  1-Dec-2020 12:40 builtin.tgz
	-rw-r--r--     0     0        78  1-Dec-2020 12:40 builtin.tgz.cksum
	-rw-r--r--     0     0        91  1-Dec-2020 12:40 builtin.tgz.md5sum
	----------     0     0       362  1-Dec-2020 12:40 fwupdate.sh
	-rw-r--r--     0     0  10994684  1-Dec-2020 12:40 initramfs
	-rw-r--r--     0     0        75  1-Dec-2020 12:40 initramfs.cksum
	-rw-r--r--     0     0        89  1-Dec-2020 12:40 initramfs.md5sum
	-rwxr-xr-x     0     0   3097136  1-Dec-2020 12:40 zImage
	-rw-r--r--     0     0        86  1-Dec-2020 12:40 zImage.md5sum
	-rw-r--r--     0     0         0  1-Dec-2020 12:40 .fwpacked
Question:
This is where my hand stopped. :oops:
Since the initialization was done on my original NAS, I figured that this partition would be the same as the original configuration.
  • Q1. Therefore, wouldn't a [Write] here revive the files?
    Q2. Also, I thought my filesystem was ext4, but it says "Linux Raid" here, what do I do?
    Q3. What do I do next? For example, at first I was going to try to apply fsck.ext4(on Ubunto on VMWare) to Partition #4, but then I got scared.
I would appreciate any advice.

The testdisk.log is here.
https://pastebin.com/qfnuZ3zM

Thanks to the developers and the community.
Top
recuperation
Posts: 2729
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: I formatted HDD(called "Volume2"). How to recover it?

#2 Post by recuperation »

harupiyo wrote: ↑01 Dec 2020, 09:53 Question:
This is where my hand stopped. :oops:
Since the initialization was done on my original NAS, I figured that this partition would be the same as the original configuration.
  • Q1. Therefore, wouldn't a [Write] here revive the files?
    Q2. Also, I thought my filesystem was ext4, but it says "Linux Raid" here, what do I do?
    Q3. What do I do next? For example, at first I was going to try to apply fsck.ext4(on Ubunto on VMWare) to Partition #4, but then I got scared.
Q1: No, the partition structure looks ok. Rewriting it does not change anything. The problem is that your 4. partition cannot be read by Testdisk.
Q2: I don't know.
Q3: Use Photorec on the broken partition.
Top
harupiyo
Posts: 2
Joined: 01 Dec 2020, 08:51

Re: I formatted HDD(called "Volume2"). How to recover it?

#3 Post by harupiyo »

Thanks for the right advice.

I'll create a cloned disk and try a data recovery software such as Photorec.
Top
Locked

Return to “Partition Recovery”