Lost ext4

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
theller
Posts: 5
Joined: 26 Nov 2013, 16:54

Lost ext4

#1 Post by theller »

Yes, I know...backup, anyway gparted crashed and killed the hard drive that had my user data (Ubuntu 12.04 is on a separate ssd). The drive had 2 partitions, one ext4 and one ntfs. I really want the ext4 (i never used the windows side but it would be nice to get my iTunes library back). BTW Win7 is also on a separate ssd. I tried testdisk and here is the output:

Code:

Mon Nov 25 18:27:38 2013
Command line: TestDisk

TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 3.2.0-56-generic (#86-Ubuntu SMP Wed Oct 23 09:20:45 UTC 2013) x86_64
Compiler: GCC 4.6
Compilation date: 2012-02-05T07:15:52
ext2fs lib: 1.42, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 58626288 sectors
/dev/sda: user_max 58626288 sectors
/dev/sda: native_max 58626288 sectors
/dev/sda: dco 58626288 sectors
/dev/sdb: LBA, HPA, LBA48, DCO support
/dev/sdb: size 125045424 sectors
/dev/sdb: user_max 125045424 sectors
/dev/sdb: native_max 125045424 sectors
/dev/sdb: dco 125045424 sectors
/dev/sdc: LBA, HPA, LBA48, DCO support
/dev/sdc: size 2930277168 sectors
/dev/sdc: user_max 2930277168 sectors
/dev/sdc: native_max 2930277168 sectors
/dev/sdc: dco 2930277168 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 30 GB / 27 GiB - CHS 3649 255 63, sector size=512 - KINGSTON SSDNOW 30GB, S/N:40FM104UM83Z, FW:AJXA0202
Disk /dev/sdb - 64 GB / 59 GiB - CHS 7783 255 63, sector size=512 - M4-CT064M4SSD2, S/N:0000000011490324B81B, FW:0309
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182401 255 63, sector size=512 - ST1500DL003-9VT16L, S/N:5YD4GNYG, FW:CC32
Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121600 255 63, sector size=512 - WD Ext HDD 1021, FW:2002

Partition table type (auto): Intel
Disk /dev/sdc - 1500 GB / 1397 GiB - ST1500DL003-9VT16L
Partition table type: Intel

Interface Advanced
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
1 E extended LBA 148862 97 1 182401 254 63 538813989
5 L HPFS - NTFS 148862 97 51 182401 254 63 538813939

Analyse Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182401 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
1 E extended LBA 148862 97 1 182401 254 63 538813989
No partition is bootable
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 148862 97 51 182401 254 63 538813939
5 L HPFS - NTFS 148862 97 51 182401 254 63 538813939
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182402 255 63
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182402 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery

search_part()
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182402 255 63

block_group_nr 3

recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/5468, s_mnt_count=0/27, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 179200248
recover_EXT2: part_size 1433601984
Linux 0 1 1 89237 153 3 1433601984 [shared_drive]
EXT4 Large file Sparse superblock Backup superblock, 734 GB / 683 GiB
NTFS at 89237/153/5
filesystem size 538802161
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 34331452
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 89237 153 5 122776 123 20 538802161
NTFS, 275 GB / 256 GiB
BAD_RS LBA=4192795945 11129726
check_FAT: can't read FAT boot sector
check_part_i386 failed for partition type 01
FAT12 260989 121 38 439142 63 18 2862024272
This partition ends after the disk limits. (start=4192795945, size=2862024272, end=7054820216, disk end=2930288130)
check_part_i386 failed for partition type 07
HPFS - NTFS 148862 97 51 182401 254 63 538813939
NTFS at 182401/68/3
filesystem size 538802161
sectors_per_cluster 8
mft_lcn 4
mftmirr_lcn 34331452
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 148862 97 51 182401 68 3 538802161
NTFS found using backup sector!, 275 GB / 256 GiB
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182402 255 63
Check the harddisk size: HD jumpers settings, BIOS detection...
The harddisk (1500 GB / 1397 GiB) seems too small! (< 3612 GB / 3364 GiB)
The following partition can't be recovered:
FAT12 260989 121 38 439142 63 18 2862024272
get_geometry_from_list_part_aux head=255 nbr=1
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=1

Results
Linux 0 1 1 89237 254 63 1433608407 [shared_drive]
EXT4 Large file Sparse superblock Backup superblock, 734 GB / 683 GiB
HPFS - NTFS 89237 153 5 122776 254 63 538810457
NTFS, 275 GB / 256 GiB
HPFS - NTFS 148862 97 51 182401 254 63 538813939
NTFS found using backup sector!, 275 GB / 256 GiB
HPFS - NTFS 148862 97 51 182401 254 63 538813939

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

Analyse Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182402 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 07
Current partition structure:
1 E extended LBA 148862 97 1 182401 254 63 538813989
No partition is bootable
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 148862 97 51 182401 254 63 538813939
5 L HPFS - NTFS 148862 97 51 182401 254 63 538813939
Ask the user for vista mode
Allow partial last cylinder : Yes
search_vista_part: 1

search_part()
Disk /dev/sdc - 1500 GB / 1397 GiB - CHS 182402 255 63
Search for partition aborted

Results

interface_write()

No partition found or selected for recovery
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition

TestDisk exited normally.

So it looks like the data is still there? I then tried
sudo mke2fs -n /dev/sdc
Code:

mke2fs 1.42 (29-Nov-2011)
/dev/sdc is entire device, not just one partition!
Proceed anyway? (y,n) y
Filesystem label=
OS type: Linux
Block size=4096 (log=2)
Fragment size=4096 (log=2)
Stride=0 blocks, Stripe width=0 blocks
91578368 inodes, 366284646 blocks
18314232 blocks (5.00%) reserved for the super user
First data block=0
Maximum filesystem blocks=4294967296
11179 block groups
32768 blocks per group, 32768 fragments per group
8192 inodes per group
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968,
102400000, 214990848

Then:
sudo e2fsck -b 8193 -B 4096 /dev/sdc
and got:

Code:

e2fsck 1.42 (29-Nov-2011)
e2fsck: Bad magic number in super-block while trying to open /dev/sdc

The superblock could not be read or does not describe a correct ext2
filesystem. If the device is valid and it really contains an ext2
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193 <device>

I used photorec and it could recover files so something is on the disc but I would love to recover the partition. The whole drive is 1.5 TB but the partition was about half. I now have a 1TB drive I am going to put in the computer but it's still not big enough to copy the damaged drive.

Help? What next? I feel like I am not using testdisk properly.
I looked at http://www.cgsecurity.org/wiki/Advanced ... SuperBlock and I don't see the SUPERBLOCK option.

From this site: http://www.cgsecurity.org/wiki/Menu_Analyse I saw the Load Backup option and I think I was supposed to press L before enter?
Code:

TestDisk 6.5-WIP, Data Recovery Utility, November 2006
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63
Partition Start End Size in sectors
* FAT32 0 1 1 1010 254 63 16241652 [NO NAME]
P Linux 1011 0 1 1023 254 63 208845 [/boot]
D Linux 1024 1 1 3573 254 63 40965687
D Linux RAID 1024 1 1 3573 254 63 40965687 [md0]
D Linux 3574 1 1 4210 254 63 10233342
D Linux RAID 3574 1 1 4210 254 63 10233342 [md1]
L Linux 4211 1 1 14592 254 63 166786767

Structure: Ok. Use Up/Down Arrow keys to select partition.
Use LEFT/RIGHT Arrow keys to CHANGE partition characteristics:
*=Primary bootable P=Primary L=Logical E=Extended D=Deleted
Keys A: add partition, L: load backup, T: change type, P: list files,
ENTER: to continue
FAT32, 8315 MB / 7930 MiB

What else can I share or do?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost ext4

#2 Post by Fiona »

I assume, your 1.5 TB-Disk might be the affected one?
Here are the results of you current situation from your provided log.

Code: Select all

Current partition structure:
1 E extended LBA 148862 97 1 182401 254 63 538813989
No partition is bootable
Invalid NTFS or EXFAT boot
5 L HPFS - NTFS 148862 97 51 182401 254 63 538813939
5 L HPFS - NTFS 148862 97 51 182401 254 63 538813939
You have no ext4-partition in your partition table?
Your NTFS-partition might have a corrupted boot sector?

Your results are;
Results
Linux 0 1 1 89237 254 63 1433608407 [shared_drive]
EXT4 Large file Sparse superblock Backup superblock, 734 GB / 683 GiB
HPFS - NTFS 89237 153 5 122776 254 63 538810457
NTFS, 275 GB / 256 GiB
HPFS - NTFS 148862 97 51 182401 254 63 538813939
NTFS found using backup sector!, 275 GB / 256 GiB
HPFS - NTFS 148862 97 51 182401 254 63 538813939
Before you're going to change anything to your partition or partition table, boot sector etc.. you should check your partition and press p to have a try to list your data.
If you can watch your data, you can press enter and using Write.
In case, it might be necessary to have a try to repair your superblock!
http://www.cgsecurity.org/wiki/Advanced ... SuperBlock
As far as I know, it's for ext4 partitions valid too.
I'm not a linux tech savvy, that's why I recommend, if you're able to list your files using testdisk on your ext4-partition, you can copy/backup your important data to another healthy disk/partition/media.
On the bottom of the screen you'll find all the copy commands and if you check that two dots on the upper area of the screen and press enter, you'll get a diretory up, until you get to the disk selection.
So you can select another healthy disk where you can copy your data to.
If you don't change any disk or directory, standard path is your testdisk folder.

Fiona

theller
Posts: 5
Joined: 26 Nov 2013, 16:54

Re: Lost ext4

#3 Post by theller »

I ran the testdisk deep search and asked to list the files of the ext4 partition and the response was:

No file found, filesystem may be damaged.

As for the files I found with photorec, I think they are the files from the ntfs partition (many mp3 and no flac).

Anyone know why I don't have the SuperBlock option?

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Lost ext4

#4 Post by Fiona »

Did you already write your ext4-partion into your partition table?
You must first use TestDisk / Analyse and Quick or Deeper Search until your partition is found.
Then you have to write it to your partition table.
Your partition must be set as Primary and if you press enter, you'll get to the screen to confirm with write.
Only if your ext4-partition is in your partition table, you can make a diagnose of your superblock using the menu Advanced.

Fiona

theller
Posts: 5
Joined: 26 Nov 2013, 16:54

Re: Lost ext4

#5 Post by theller »

I'm in the airport and won't be able to try anything until Saturday. Thanks for your help.

theller
Posts: 5
Joined: 26 Nov 2013, 16:54

Re: Lost ext4

#6 Post by theller »

After a month I am back on this project and I hope I can still get help. I copied the damaged 1.5TB drive to a 2TB using dd. I know there are files on it because I was able to pull them off with photorec.

I thought I added the partition but I don't think I did it correctly. Now I get:

Linux 0 32 33 89237 153 4 1433600000 [shared_drive]
Linux 0 1 1 89237 153 3 1433601984 [shared_drive]

The second one is the original partition. That is the one I want to restore. The first one I created with gparted but it seems to not be in the right spot. I am going to look for a linux tool to manually make the partition. Does testdisk do that? What can I do or post?

Locked