Page 1 of 1

[solved]Recovery of Linux partions

Posted: 18 Jul 2014, 09:13
by biaaas

at the moment I try to recover a Linux system after a hdd failure. After a system update the machine did not reboot so I turned it off manually. After that it could not boot anymore, so I got a systemrescuecd and had a look. In gparted the hdd showed up as completly unlocated. So I gave testdisk a try, the scans showed an error at an low cylinder count (~5800 of ~120k). After accidently writing a new mbr, I thought it would be better to make a copy. So I used ddrescue to clone the drive on to an identical one. ddrescue could copy the hole disk, except the damaged part which is only ~1.5MB (the disk has 1 TB).
I now used tesdisk to scan the new disk. Since the result with "intel PC partion" made no sense and I could not see any folders. I also tried "None" and "Efi GPT". For all options I did also a "deep scan". Now I am totally confused what to do. The result from the "None" not-deep-scan, where the most reasonable (3 Partitions: a small ext3/4, a big ext3/4 and swap). There I could also access the files, but almost everything is missing.
Due all the scans the logfile got a bit big, so I put it here for download:
If you don't want to download please point me to some parts that could help and I try to copy-paste them.
Just for clarification sda is the faulty drive, sdb is the drive with the copy of sda. Both are Seagate 1TB with 4k sectorsize but are emulating 512k. The structure I am looking for is a ~100GB ext partition for boot and root, a ~890 GB for /home and a ~8GB for swap. If I remember right there should be also a very small unlocated part.

Sorry for the lengthy text. I hope you can help with that.

Thanks in advance!

Re: Recovery of Linux partions

Posted: 19 Jul 2014, 22:47
by biaaas
I played a bit around with the sectorsize when using the default "none" and 512kB the first partion starts cylinder 6. When using 4096kB the first partion starts at cylinder 0.

Does this mean I have a geometry Problem? If yes how will I find the right one?

Re: Recovery of Linux partions

Posted: 22 Jul 2014, 10:18
by biaaas
I think I am on the right way now. There were two things that prevented me from progress. First I was not aware that the Ubuntu installer creates an efi partition table by default. Second the efi deep scan finds over 200 partitions and I just overlooked the right one.

Re: [solved]Recovery of Linux partions

Posted: 22 Jul 2014, 13:55
by biaaas
I could recover the home partition which contained all the important data. It would have been nice to also recover the system partition, but the scan found so many partitions that doing "p" ,"q" "arrow down" just made me mad :D. I spoke of 200 in my last post, but now I think there were more than 400. Also after some time I tended to press "q" to early and had to redo the deep scan.
This leads me to my final questions:
  1. Why are there so much partitions? Is this the history of the drive? Or did I "break" it by writing that mbr?
  2. Will a dd /dev/zero "whipe" erase all this information? Just in case I have to scan again and don't want to search hundreds of partitions again.
Oh and I forgot to thank the developer for this nice tool!!!

Re: [solved]Recovery of Linux partions

Posted: 20 Aug 2014, 05:18
by josh
biaaas wrote:I spoke of 200 in my last post, but now I think there were more than 400. Also after some time I tended to press "q" to early and had to redo the deep scan.
Though your issue is resolved, and this is just for curiosity's sake;

When scanning my own large drive, tonnes of partitions showed up, and it turns out testdisk was reading various disk image files as partitions (which, they were, but I did not expect them to show up).

Floppy disk images embedded in recovery tools, images of USB sticks, and so on.
Talk about thorough!

Re: [solved]Recovery of Linux partions

Posted: 20 Aug 2014, 09:19
by biaaas
Thanks for your answer. But I am not aware of any image files on that drive. Though I don't know what comes with the standard ubuntu installation.