Novice trying to recover partitions. Help needed.

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
anilswipe
Posts: 8
Joined: 04 Apr 2021, 12:43

Novice trying to recover partitions. Help needed.

#1 Post by anilswipe »

Hello everybody,

I am new to the forum and a computer novice and have come to seek help to recover my lost partitions and the data inside them.

Information regarding the machine I use:
It is a 10 year old Laptop with i3 early M series processor, 3 GB RAM and 300 GB HDD. The operating system on it was 'antiX-Frugal'. My HDD was partitioned from sda1 to sda7, if I can remember. There were 4 partitions with an extended partition among them.

How I lost the partitions:
I was working with Gparted to create partition table. I was under the notion that Gparted commits the selected action only when asked to but I was wrong. I chose msdos partition from 'Device' drop down menu. I got a warning that the entire disk will be erased, but I thought it will be only after I 'Apply the actions'. However that moment I chose to go ahead, the entire disk became 'Unallocated' to my terrible shock. I lost very important data compiled for nearly 10 years, which also contains some painstakingly accumulated educational research matter for my student son.

However, after regaining my composure and summing up sobriety, it came to my mind that it is possible to recover. Immediately I searched the web for related information. I read regarding Testdisk. However, I do not have the expertise and knowledge to use it properly to recover the lost partitions and data. I read about it and gathered information.

What I did after that:
I knew that if no new data is written to the disk and the disk is left without making any changes, the possibility of recovering is high. So I did not attempt recovery as I had no proper information to recover and so I had to acquire information to do so and I did not write to the disk also. So the disk is as it was when I lost the partitions and data. Further, I booted with a antiX live USB and installed 'Test disk' on it and analyzed the disk. Here below is the information I got from it.

Uploaded images:
Screenshot1.jpg
Screenshot1.jpg (52.59 KiB) Viewed 1919 times
Screenshot2.jpg
Screenshot2.jpg (28.89 KiB) Viewed 1919 times
Then after that with deeper analysis I got this
Screenshot3.jpg
Screenshot3.jpg (34.85 KiB) Viewed 1919 times

The partition layout:
The large NTFS partition is at the beginning of the disk and the /home partition is at the end of the disk. The two separate ext4 partitions, one labeled as 'Virtual Machines' and the other labeled as 'antiX-Frugal' as shown in the above image are in the middle of the disk. The /home, swap & / (i.e. antiX-Frugal) partitions were on the extended partition at the end of the disk.

What I seek to do:
My main concern is recovering the study material in the form of text (Notepad, LO-Writer, PDF), images and videos on the large NTFS partition and the ext4 /home partition.

I am less concerned about the other partitions like the ext4 'Virtual Machines' and ext4 /dev/sda7 'antiX-Frugal' shown in the above image which are in the middle of the disk. I can reconstruct them though with pretty much hard work but I don't think I can regain the educational information accumulated over so many years. It is a lost trail of thoughts.

I realize, I made a big mistake by not backing up the data :oops: . For nearly a decade, I had taken care not to loose the data without backing up, but now this happened. :cry:

My main imminent queries:
  • Testdisk says that the NTFS partition can't be recovered (3rd image). So is that the end of it? Are there any other ways of recovering the data on it? However, I tried to copy paste some small files to the live USB, which I was successful in doing. So I suppose there are still some hopes. I would continue experimenting through the night to recover as many files as possible.
  • Can I paste the recovered files to the same erased disk and still recover the lost files or is it better to get another storage media to save the recovered files to keep the chances of recovering the lost files high?
  • Is it possible to use another Laptop which has enough internal empty space on its HDD and use it as recovery space? If so how do I connect the two? Or do I have to purchase an external USB hard disk or something like it?
  • Which are the web source links where a step by step guide is given regarding my specific case, if it is possible to recover the data?
I would greatly appreciate any help extended in this regard.

Thank you & best regards to everybody
Anil
Last edited by anilswipe on 05 Apr 2021, 00:20, edited 2 times in total.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Novice trying to recover partitions. Help needed.

#2 Post by recuperation »

Please upload your screenshots to your post using the attachment tab on the bottom of the page. It appears when you edit your post.

anilswipe
Posts: 8
Joined: 04 Apr 2021, 12:43

Re: Novice trying to recover partitions. Help needed.

#3 Post by anilswipe »

Thank you for the suggestion, recuperation.

However, I could only attatch 3 images.

Regards
Anil

anilswipe
Posts: 8
Joined: 04 Apr 2021, 12:43

Re: Novice trying to recover partitions. Help needed.

#4 Post by anilswipe »

Deleted post as it had appeared twice.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Novice trying to recover partitions. Help needed.

#5 Post by recuperation »

anilswipe wrote: 04 Apr 2021, 15:51 Hello everybody,

I am new to the forum and a computer novice and have come to seek help to recover my lost partitions and the data inside them.

Information regarding the machine I use:
It is a 10 year old Laptop with i3 early M series processor, 3 GB RAM and 300 GB HDD. The operating system on it was 'antiX-Frugal'. My HDD was partitioned from sda1 to sda7, if I can remember. There were 4 partitions with an extended partition among them.

How I lost the partitions:
I was working with Gparted to create partition table. I was under the notion that Gparted commits the selected action only when asked to but I was wrong. I chose msdos partition from 'Device' drop down menu. I got a warning that the entire disk will be erased, but I thought it will be only after I 'Apply the actions'. However that moment I chose to go ahead, the entire disk became 'Unallocated' to my terrible shock.
Maybe that was only the graphical representation showing the effect of a job still to be done.

I lost very important data compiled for nearly 10 years, which also contains some painstakingly accumulated educational research matter for my student son.

However, after regaining my composure and summing up sobriety, it came to my mind that it is possible to recover. Immediately I searched the web for related information. I read regarding Testdisk. However, I do not have the expertise and knowledge to use it properly to recover the lost partitions and data. I read about it and gathered information.

What I did after that:
I knew that if no new data is written to the disk and the disk is left without making any changes, the possibility of recovering is high. So I did not attempt recovery as I had no proper information to recover and so I had to acquire information to do so and I did not write to the disk also. So the disk is as it was when I lost the partitions and data. Further, I booted with a antiX live USB and installed 'Test disk' on it and analyzed the disk. Here below is the information I got from it.

Uploaded images:
Screenshot1.jpg
Screenshot2.jpg

Then after that with deeper analysis I got this
Screenshot3.jpg


The partition layout:
The large NTFS partition is at the beginning of the disk and the /home partition is at the end of the disk. The two separate ext4 partitions, one labeled as 'Virtual Machines' and the other labeled as 'antiX-Frugal' as shown in the above image are in the middle of the disk. The /home, swap & / (i.e. antiX-Frugal) partitions were on the extended partition at the end of the disk.

What I seek to do:
My main concern is recovering the study material in the form of text (Notepad, LO-Writer, PDF), images and videos on the large NTFS partition and the ext4 /home partition.

I am less concerned about the other partitions like the ext4 'Virtual Machines' and ext4 /dev/sda7 'antiX-Frugal' shown in the above image which are in the middle of the disk. I can reconstruct them though with pretty much hard work but I don't think I can regain the educational information accumulated over so many years. It is a lost trail of thoughts.

I realize, I made a big mistake by not backing up the data :oops: . For nearly a decade, I had taken care not to loose the data without backing up, but now this happened. :cry:

My main imminent queries:
  • Testdisk says that the NTFS partition can't be recovered (3rd image). So is that the end of it? Are there any other ways of recovering the data on it? However, I tried to copy paste some small files to the live USB, which I was successful in doing.
Please rerun your live operating system and use the "p"-key when being in the menu shown in screenshot1.jpg. Maybe nothing happened and your NTFS partition is still OK.

So I suppose there are still some hopes. I would continue experimenting through the night to recover as many files as possible.[/list]
  • Can I paste the recovered files to the same erased disk and still recover the lost files or is it better to get another storage media to save the recovered files to keep the chances of recovering the lost files high?
You normally put your stuff to another healthy drive with enough space.
  • Is it possible to use another Laptop which has enough internal empty space on its HDD and use it as recovery space? If so how do I connect the two? Or do I have to purchase an external USB hard disk or something like it?
The easiest way is when both machine are accessible over a network. You can share folders on the second machine to have a target to copy to. Another way would be to remove one of the harddrives in question from the laptop they are residing in and connect those extracted drives by putting them into a docking station. If you want to buy a drive make sure that it has its own mains power supply or buy a naked drive and put it into a docking station. This hint aims at ensuring a proper power supply for the target disk.
  • Which are the web source links where a step by step guide is given regarding my specific case, if it is possible to recover the data?
Go to www.cgsecurity.org and cross-read the pages, the wiki, the manual and the forum.

anilswipe
Posts: 8
Joined: 04 Apr 2021, 12:43

Re: Novice trying to recover partitions. Help needed.

#6 Post by anilswipe »

Thank you recuperation, for the reply.
Maybe that was only the graphical representation showing the effect of a job still to be done.
Immediately after that I had closed Gparted, rebooted and verified. I could not boot. I booted with live USB and checked in Gparted. The disk was still in 'unallocated' state.

However, now I am in a new problem.

I successfully recovered the partitions and all the data on it with the help of Testdisk. After Testdisk recognized the partitions, I did, 'write & reboot' and everything was back to normal. But it got messed up again.

After that, I am not exactly sure what happened. I got carried away and the first thing I did was, I took out one of my old SD cards that was unusable, with the hopes of recovering it too. It had two partitions. One FAT32 & the other NTFS. I was not able to delete the partitions and format it. I tried all sorts without success. Then I tried by changing the NTFS file type to FAT32, also without success. So I gave up hopes and removed the SD card. However I was shocked to find that my harddrive on which there is a NTFS partition too, had aslo been changed to FAT32 and was unusable. It is the partition on which all my data resides.

I started Testdisk again, but this time it is not recognizing the partition as NTFS. It is recognizing it as a FAT32 partition. I tried to change it back to NTFS with the 't' option, but after choosing 't' the option to finalize it, i.e. 'write', does not show.
Screenshot 1.jpg
Screenshot 1.jpg (47.91 KiB) Viewed 1850 times
Screenshot 2.jpg
Screenshot 2.jpg (39.08 KiB) Viewed 1850 times
Screenshot 3.jpg
Screenshot 3.jpg (39.08 KiB) Viewed 1850 times
What should I do now? What could have happened? How to revert back to previous working state? Please give suggestions.

Thank you and best regards
Anil

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Novice trying to recover partitions. Help needed.

#7 Post by recuperation »

If your SD card refuses write operation it is most probably broken. Some might have a little write protection switch. You might check that.
Please get yourself a test environment for your experiments to ensure that you can practice things safely.
Which partition did you successfully recover before messing your things up?

anilswipe
Posts: 8
Joined: 04 Apr 2021, 12:43

Re: Novice trying to recover partitions. Help needed.

#8 Post by anilswipe »

Thanks recuperation,
Which partition did you successfully recover before messing your things up?
I had successfully recovered the large NTFS data partition, on which all my data resides, on the 300GB HDD regarding which queried in my first original post.
Please get yourself a test environment for your experiments to ensure that you can practice things safely.
That was a great suggestion but actually I didn't know what a test environment is. I have to gather information, now.

Thanks & best regards.

recuperation
Posts: 2718
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Novice trying to recover partitions. Help needed.

#9 Post by recuperation »

anilswipe wrote: 06 Apr 2021, 23:44 Thanks recuperation,
Which partition did you successfully recover before messing your things up?
I had successfully recovered the large NTFS data partition, on which all my data resides, on the 300GB HDD regarding which queried in my first original post.
Please get yourself a test environment for your experiments to ensure that you can practice things safely.
That was a great suggestion but actually I didn't know what a test environment is. I have to gather information, now.
A test environment is a second computer for testing purposes where you can practice things like partitioning p.e. witthout losing valuable files.

Please compare Screenshot1 of your first posting to Screenshot1 of your later posting. The NTFS partition is missing. I guess you recovered the first one.
Unfortunately your second try to recover the NTFS partition didn't show it anymore. That seems as if its boot sector has been deleted.
I would try nevertheless to create a partition manually at the old location. Maybe you have somebody around who would do that for you.
If you want to do this despite of your latest experiences I would duplicate the drive using ddrescue as described in the manual.

Then you could rerun Testdisk to see if Testdisk allows you to look inside.

anilswipe
Posts: 8
Joined: 04 Apr 2021, 12:43

Re: Novice trying to recover partitions. Help needed.

#10 Post by anilswipe »

Thank you, recuperation for the guidance.
Unfortunately your second try to recover the NTFS partition didn't show it anymore. That seems as if its boot sector has been deleted.
Yes you are right, that is what had happened. Testdisk said so.

Since the last post, while I was working with Testdisk, it said the boot sector has gone bad but the backup boot sector is OK. Then I took cue from one of the threads from this forum which discussed similar experience, where the OP repaired the BS by using the option to repair with the backup BS. I did similarly and also changed the type from FAT32 to the original NTFS by using the 't' option. Now the partition is showing as below. However, things have not improved much. Further, the other partition which was ext4, which had also changed to FAT32, I haven't done anything about it, it still shows as FAT32.
Screenshot 1.jpg
Screenshot 1.jpg (50.74 KiB) Viewed 1713 times
There is one more thing I attempted. Since the NTFS partition has no OS on it (it earlier had the Windows OS on it, but I have removed it now.), I thought it no more needed to be a boot partition, so with the help of Gparted, I un-selected the 'boot' option in the 'Manage flags' section. I don't know if it is going to be of any help. It hasn't improved things. In Testdisk, when I go to Advanced > List, Testdisk says 'Can't open filesystem. Filesystem seems damaged.' as below.
Screenshot 4.jpg
Screenshot 4.jpg (47.7 KiB) Viewed 1713 times
Screenshot 5.jpg
Screenshot 5.jpg (29.09 KiB) Viewed 1713 times
Unfortunately, I live in a small town, where people are not acquainted with these things, the main occupation here is agriculture, so there are none to help me in this regard. Further, probably I am the only guy using Linux OS here. If at all I have to take it to the servicing center, the percentage of people using Linux is hardly 3% in the entire country and the chances of the servicing center to consider my case are almost nil. Even if they consider, the chances of resolving my issue are remote and data loss is more probable. So my best option is to seek help from the web. I am really grateful for your valuable guidance.

Further I have done other things discussed below:
Since all my data resided on the NTFS /dev/sda1, I was not much concerned about the other sections of the HDD. So I formatted the sections on which the antix-Frugal OS and the Linux-swap partitions resided with the exact previous sizes and the exact location on the disk so that it does not disturb the status of the 'NTFS /data' partition. I installed the antix-Frugal OS in its earlier location and created an ext4 partition in the earlier locations of the Swap partition as 'TemporaryData' to store some data like the screenshots that I am uploading now and to use the system at least to some extent for some work till this issue is resolved. So now the earlier Swap partition shows as 'TemoraryData' partition.

Am I right in changing the type from FAT32 to NTFS in Testdisk and un-selecting the boot option in Gparted and installing the OS and creating the 'TemporaryData' partition from Swap? Or did I mess up things further?

Thank you & best regards
Anil

Locked