Cannot recover ext4 /home partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
zeiz
Posts: 4
Joined: 07 Sep 2012, 13:27

Cannot recover ext4 /home partition

#1 Post by zeiz »

Disaster...I got Dell D800 laptop with dead display and no OS and I tried to install on it something that would work with external monitor. The only linux distro that worked out of box was Parted Magic and then I decided to try Salix (I tried it already in VirtualBox and I like the distro). However I couldn't manage the "blind" install and I decided to install Salix on my work desktop and write down all the installation steps to use then only keyboard while installing on the laptop. My work system has 2 sata HDDs 500Gb each. The motheboard has also 1 IDE channel and I put there 80Gb HDD from the laptop. In BIOS this IDE disk became 1st and I started installation. Right away I noticed that I have a choice of 3 disks without any disk sizes: just sda, sdb, sdc so I couldn't recognize which drive is what. I went back to bios and disabled 2 SATA channels ...just in case. At the booting menu I then noticed that I only have 1 hdd (80Gb) and cdrom. Fine, I started installation with piece in mind ... to find out that I installed Salix on my main HDD! :o

Well now I'm trying to recover my main HDD. It was partitioned like this:
1PP - experimental partition, last was Win8 (whipped), ntfs;
2PP - FreeBSD, ufs2;
3EP - extended with swap, Ubuntu,ext4 and empty LP,ext2, 160GB;
4PP - storage fat32, 100GB,full

It looks like this now:
1PP Linux /boot
2PP Linux swap
3PP Linux (Salix)

The deep scan results:
Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63
Partition Start End Size in sectors
* Linux 0 1 1 764 254 57 12289656
P Linux Swap 765 0 1 892 254 47 2056304

D Linux 893 0 1 60800 254 59 962422016
D Linux 1848 1 1 5763 250 62 62910224 [Foreskin]
D Linux Swap 9138 1 1 10181 254 42 16771776
D Linux 10182 1 1 29762 254 57 314568696
D Linux 26239 1 1 32112 254 60 94365744
D Linux 29142 0 1 35015 253 60 94365744
D Linux 29763 1 1 42816 254 56 209712440
D Linux 34970 162 9 40714 161 7 92277296 [/]
D Linux 34971 37 11 40715 36 9 92277296 [/]
D Linux 34974 19 54 40718 18 52 92277296 [/]
D Linux 34982 190 25 40726 189 23 92277296 [/]
D Linux 38248 1 1 42294 202 59 65011712 [LV4]
D FAT12 39718 0 7 39718 45 51 2880 [NO NAME]
D Linux 40635 12 18 46248 11 11 90172776
D Linux 40637 87 27 46250 86 20 90172776
D Linux 42295 1 1 46210 254 58 62910472 [LV5]
D Linux 42817 1 1 47746 254 60 79200384
D Linux 42817 8 8 47746 227 33 79198208
D Linux 46211 1 1 47746 254 62 24675776 [LV6]
D FAT32 LBA 47747 0 1 60800 254 63 209712510 [storage]
TestDisk successfully recovered fat32 storage partition so I lost almost nothing in storage (it's a magic btw!)
I couldn't find any presence of FreeBSD, pitty but it's not really big loss: almost no documents were there.
My main OS was Ubuntu (lots of documents) and it looks like TestDisk successfully recovered the ext4 however I could save everything except /home partition (where the documents obviously resided).
I don't remember I played with encryption but if open /home it shows:

Code: Select all

drwxr-xr-x     0     0      4096 30-Apr-2010 16:13 .
 drwxr-xr-x     0     0      4096 14-Aug-2012 09:48 ..
 dr-x------  1000  1000      4096 30-Apr-2010 15:22 <user_name>
 drwxr-xr-x     0     0      4096 30-Apr-2010 15:18 .ecryptfs
 lrwxrwxrwx     0     0        44 30-Apr-2010 16:13 .directory
and when I enter the <user_name> directory I can only see this:

Code: Select all

dr-x------  1000  1000      4096 30-Apr-2010 15:22 .
 drwxr-xr-x     0     0      4096 30-Apr-2010 16:13 ..
 lrwxrwxrwx  1000  1000        31 30-Apr-2010 15:18 .ecryptfs
 lrwxrwxrwx  1000  1000        30 30-Apr-2010 15:18 .Private
 lrwxrwxrwx  1000  1000        52 30-Apr-2010 15:18 README.txt
 lrwxrwxrwx  1000  1000        56 30-Apr-2010 15:18 Access-Your-Private-Data.desktop
 drwx------  1000  1000      4096 30-Apr-2010 15:22 .cache
Copying gives just empty /home/<user_name> directories, I cannot even read the misterious README.txt. :cry:
Theoretically I can redo all the documents lost but with an exception of my kids' pictures...obviously.
Just got a thought: Salix is not very large and it resides now somewhere at the beginning of HDD where empty partition of ~30GB was located. Maybe it's possible to delete it and somehow restore then entire HDD to it's conditions before the accident?
Please help.

zeiz
Posts: 4
Joined: 07 Sep 2012, 13:27

Cannot recover ext4 /home partition

#2 Post by zeiz »

...Sorry, I forgot to post
fdisk -p output:

Code: Select all

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *          63    12289724     6144831   83  Linux
/dev/sda2        12289725    14346044     1028160   82  Linux swap / Solaris
/dev/sda3        14346045   976768064   481211010   83  Linux

zeiz
Posts: 4
Joined: 07 Sep 2012, 13:27

Re: Cannot recover ext4 /home partition

#3 Post by zeiz »

After some manipulations I got this:

Code: Select all

Disk /dev/sda - 500 GB / 465 GiB - CHS 60802 255 63

     Partition                  Start        End    Size in sectors
> 1 P Linux                    0  32 33   892 225 37   14342144
  3 E extended LBA           893   0  1 47746 254 63  752709510
  5 L Linux Swap            9138   1  1 10181 254 42   16771776
    X extended             10182   0  1 29762 254 57  314568759
  6 L Linux                10182   1  1 29762 254 57  314568696
    X extended             29763   0  1 47746 227 33  288911229
  7 L Linux                29763   1  1 47746 227 33  288911166
  4 P FAT32 LBA            47747   0  1 60800 254 63  209712510 [storage]
Questions:
1. What is "X extended" without partition number?
2. How to get rid of it?
3. Partition numbers: 1 3,4,5,6,7. Where is "2"?

Actually extended partition #3 supposed to start at linux swap, i.e. at 9138 but it starts at 893.
I tried to reduce it with gparted but got error: "cannot have overlapping partitions".
Gparted shows unallocated space in between 893 and 9138 but #3 extended cannot be shrank.

Any help highly appreciated.

zeiz
Posts: 4
Joined: 07 Sep 2012, 13:27

Re: Cannot recover ext4 /home partition

#4 Post by zeiz »

With TestDisk as one of tools and with great support of Almighty I finally managed to boot the partition.
That means full recovery of the entire disk, just very few files were lost.
Thanks for watching :D

Locked