Trouble recovering ext3 partition

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Message
Author
Dima12
Posts: 10
Joined: 08 Jul 2014, 04:59

Re: Trouble recovering ext3 partition

#11 Post by Dima12 »

Still stuck with this. Any help would be greatly appreciated.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Trouble recovering ext3 partition

#12 Post by Fiona »

I've checked both log files, partition table type Intel and None
Only your Linux partition containing your OS and your swap partition are recoverable.
I didn't find any partition starting at the beginning of your disk which ends before your your OS partition starts.
The other found partitions would overlap your OS partition.
Partitions which overlap your OS partitions can't use the same space.
I'm not as much a linux tech savvy and creating a loop device?
You should ask remy or write him a PM.
Your found partitions which ends after disk limit are far beyond the disk limit, almost half of it.
It means approximately 900 GB.
If a partition ends after disk limit and you make them visible and they don't list your files, you're not able to run fsck on it.
That's why I recommend datarecovery software to have a try to recover files from your media partition.
You can try photorec.
Infos:
http://www.cgsecurity.org/wiki/PhotoRec
http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

Fiona

Dima12
Posts: 10
Joined: 08 Jul 2014, 04:59

Re: Trouble recovering ext3 partition

#13 Post by Dima12 »

Thanks so much for your help Fiona! I've run photorec and it was able to recover about 500GB of data, which is impressive but far from the 1.5TB I've lost. It also wasn't able to preserve the file names or folder structure :|

What does testdisk mean when it reports that it has found an

ext3 blocksize=4096 Large file Sparse superblock Recover, 1979 GB / 1844 GiB

Does this mean it found a backup superblock? Is there a way to use that info to mount my old partition?

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Trouble recovering ext3 partition

#14 Post by remy »

The partition found beginning @ 0/32/33 seems a good match, but with file-system corruption. You may try to mount or fsck with a superblock, but as far as it may create modifications on the file-system, you should before, in my opinion, duplicate your disk using a bit2bit copying tool like gnuddrescue.

Dima12
Posts: 10
Joined: 08 Jul 2014, 04:59

Re: Trouble recovering ext3 partition

#15 Post by Dima12 »

I think the partition at 0/32/33 is the new ext4 partition which overwrote the ext3 partition I am trying to recover. I'm not having any trouble mounting this partition.

Code: Select all

Analyse Disk /dev/sda - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
Current partition structure:
 1 * Linux                    0  32 33 242695 181 46 3898904576
Is this the partition you're talking about?

I'm interested in mounting the 1979GB ext3 partition testdisk is detecting.

Code: Select all

recover_EXT2: s_block_group_nr=0/14752, s_mnt_count=24/26, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 483398437
recover_EXT2: part_size 3867187496
     Linux                121584   0  1 362305  73 32 3867187496
     ext3 blocksize=4096 Large file Sparse superblock Recover, 1979 GB / 1844 GiB
This partition ends after the disk limits. (start=1953246960, size=3867187496, end=5820434455, disk end=3907029168)

recover_EXT2: s_block_group_nr=0/14752, s_mnt_count=24/26, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 483398437
recover_EXT2: part_size 3867187496
     Linux                121585   9 25 362306  82 56 3867187496
     ext3 blocksize=4096 Large file Sparse superblock Recover, 1979 GB / 1844 GiB
This partition ends after the disk limits. (start=1953263616, size=3867187496, end=5820451111, disk end=3907029168)

recover_EXT2: s_block_group_nr=0/14752, s_mnt_count=24/26, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 483398437
recover_EXT2: part_size 3867187496
     Linux                121593 179 59 362314 253 27 3867187496
     ext3 blocksize=4096 Large file Sparse superblock Recover, 1979 GB / 1844 GiB
This partition ends after the disk limits. (start=1953402880, size=3867187496, end=5820590375, disk end=3907029168)

recover_EXT2: s_block_group_nr=0/14752, s_mnt_count=24/26, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 483398437
recover_EXT2: part_size 3867187496
     Linux                121599 112 50 362320 186 18 3867187496
     ext3 blocksize=4096 Large file Sparse superblock Recover, 1979 GB / 1844 GiB
This partition ends after the disk limits. (start=1953495040, size=3867187496, end=5820682535, disk end=3907029168)
Is testdisk reporting these partitions because it is detecting backup superblocks from the deleted ext3 partition? If so, is there any way to calculate the location of the ext3 backup superblock from the reported CHS values?

User avatar
remy
Posts: 457
Joined: 25 Mar 2012, 10:21
Location: Strasbourg, France.
Contact:

Re: Trouble recovering ext3 partition

#16 Post by remy »

depending on your geometry (probably X/255/63) to compute LBA on CHS value the formula is :

LBA = 255*63*C + 63*H +S - 1

But as said before, it's not a good idea to run fsck without having made before a security copy of your drive…
Better try a mount read-only.

Dima12
Posts: 10
Joined: 08 Jul 2014, 04:59

Re: Trouble recovering ext3 partition

#17 Post by Dima12 »

So to mount using the backup superblock reported by testdisk

Code: Select all

recover_EXT2: s_block_group_nr=0/14752, s_mnt_count=24/26, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 483398437
recover_EXT2: part_size 3867187496
     Linux                121584   0  1 362305  73 32 3867187496
     ext3 blocksize=4096 Large file Sparse superblock Recover, 1979 GB / 1844 GiB
This partition ends after the disk limits. (start=1953246960, size=3867187496, end=5820434455, disk end=3907029168)
C=121584 H=0 S=1

I'd use

Code: Select all

mount -t ext3 -o ro,sb=255*63*121584+63*0+1-1
Or do I need to convert the LBA into something else for mount to understand it?

Locked