Windows Update Messed Up Dual Boot Partitions Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
fyodor
Posts: 5
Joined: 30 Mar 2021, 08:48

Windows Update Messed Up Dual Boot Partitions

#1 Post by fyodor »

I have a dualboot system which has an unused Windows 10 install which I decided to run update on. That resulted in a nuked partition table.

I ran the boot-repair utility recommended by the Ubuntu Help page:

https://help.ubuntu.com/community/Boot-Repair

which resulted in the system simply booting Windows instead of failing with a grub partition-not-found error. (I realize I'll have to reinstall grub later.)

Yes, I should have gone with testdisk first, but I didn't.

My disk had three primary partitions (one of which was boot) and an extended partition with two logical partitions, one my Linux install and one a swap.

Testdisk lists all the partitions except one, the primary Linux partition, which of course happens to be the only one I care about.

Quick Search correctly lists my Linux partition and the files all appear to be intact.

First question: Why are all the partitions in the Quick Search shown as Deleted, including the ones which were shown in the "current partition structure"?

This admittedly makes me a bit jumpy with the next stage of the process.

Second question: Why does selecting both partitions in the extended volume result in testdisk saying Structure: Bad? (And what should I do?)

Running testdisk:

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
Current partition structure:
     Partition                  Start        End    Size in sectors

 1 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 2 P HPFS - NTFS             63 221 31  6825  94 18  108623517
 3 P Windows RE(store)     6825  99 59  6903 137 18    1255424
 4 E extended              6903 202 18 30401  75 10  377487362
 5 L Linux Swap           30018 151 22 30401  75 10    6148096
Quick Search:

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
     Partition               Start        End    Size in sectors
>D HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 D HPFS - NTFS             63 221 31  6825  99 58  108623872
 D HPFS - NTFS           6825  99 59  6903 137 18    1255424
 D Linux                 6903 202 20 30018 151 21  371339264
 D Linux Swap           30018 151 22 30401  75 10    6148096

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Setting partitions using arrow keys:

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
     Partition               Start        End    Size in sectors
 * HPFS - NTFS              0  32 33    63 221 30    1024000 [System Reserved]
 P HPFS - NTFS             63 221 31  6825  99 58  108623872
 P HPFS - NTFS           6825  99 59  6903 137 18    1255424
 L Linux                 6903 202 20 30018 151 21  371339264
>L Linux Swap           30018 151 22 30401  75 10    6148096

Structure: Bad. Use Up/Down Arrow keys to select partition.
Setting (leaving) either of the two Linux partitions to Deleted removes the error message.

Now, I don't really *care* about the Swap partition, since it obviously doesn't hold any data, but I don't understand the error and I'd rather not make a mistake at this juncture.

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Windows Update Messed Up Dual Boot Partitions

#2 Post by recuperation »

As for your first question, the deleted status probably expresses that this is just a proposal based on a search for partition structures based on boot sector information as opposed to the information above based upon the existing partition table structure.

As for your second question,
the MBR style partition table require a free sector between certain partitions to write an extended partition table there. Testdisk complains because of the missing space for this sector.
As you can see from looking at the locations of the two partions in your analysis, the swap partition directly follows the Linux partition:

D Linux 6903 202 20 30018 151 21 371339264
D Linux Swap 30018 151 22 30401 75 10 6148096

If this partition boundaries are correct I assume you installed your systems in GPT mode. GPT table information does not require spaces between partitions.

fyodor
Posts: 5
Joined: 30 Mar 2021, 08:48

Re: Windows Update Messed Up Dual Boot Partitions

#3 Post by fyodor »

I have not manually set the partition boundaries - that was done by Ubuntu during initial install, although I guess I may have changed it with GParted at some point and completely forgotten about it.

The partition setup with the extended partition containing logical Linux and Swap partitions is one I remember and since GPT doesn't use extended partitions, I'm leaning towards this being MBR with a bad boundary on the linux/swap partitions being allowed by whatever utility was used to set them (either automatically or by me).

I admit I don't recall having selected GPT at any point and testdisk says "Intel partition table type detected":

Code: Select all

Please select the partition table type, press Enter when done.
>[Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map (legacy)
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

Hint: Intel partition table type has been detected.
Selecting EFI GPT:

Code: Select all

Current partition structure:
     Partition                  Start        End    Size in sectors

Bad GPT partition, invalid signature.
Trying alternate GPT
Bad GPT partition, invalid signature.
Selecting Quick Search takes some time and shows some errors while running:

Code: Select all

LVM magic value at 14019/182/55
FAT32 at 14536/25/60
Bad root_cluster
FAT12 at 14536/25/61
FAT1 : 1-9
FAT2 : 10-18
start_rootdir : 19
Data : 33-2879
sectors : 2880
cluster_size : 1
no_of_cluster : 2847 (2 - 2848)
fat_length 9 calculated 9
FAT differs, FAT sectors=0-9/9
heads/cylinder 2 (FAT) != 255 (HD)
sect/track 18 (FAT) != 63 (HD)
Upon Quick Search completion:

Code: Select all

TestDisk 7.1, Data Recovery Utility, July 2019
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org

Disk /dev/sda - 250 GB / 232 GiB - CHS 30401 255 63
     Partition               Start        End    Size in sectors
>P MS Data                     2048    1026047    1024000 [System Reserved]
 D MS Data                  1026048  109649564  108623517
 D MS Data                  1026048  110907391  109881344
 D MS Data                108394497  109649920    1255424
 D MS Data                109649920  110905343    1255424
 D MS Data                110907391  220788734  109881344
 D Linux filesys. data    110909438  482248701  371339264
 D MS Data                233522475  233525354       2880 [NO NAME]
 P Linux Swap             482248704  488396783    6148080
 
 Structure: Ok.  Use Up/Down Arrow keys to select partition.
 
Again, what I'm interested in recovering here is simply my Linux partition. Would I be correct in assuming that the safer option would be to recover as per my original post and simply leave the Swap partition marked Deleted?

fyodor
Posts: 5
Joined: 30 Mar 2021, 08:48

Re: Windows Update Messed Up Dual Boot Partitions

#4 Post by fyodor »

Having backed up anything really important, I decided to just assume the swap partition was poorly defined and restored the partition table without the swap. I then checked the filesystem on the restored linux partition and verified that its size matched that of the partition. Reinstalled grub and everything is back to normal, no data loss.

Slightly interesting that the testdisk partition layout changed the boundaries of the extended partition to include the ~ 2MB of unallocated space after the third Primary partition. Not that it makes any difference.

And, since I couldn't find it this time, I'm making another copy of the partition table - always nice to have in case Windows or something else mucks things up.

Thanks for the help!

Locked