Page 1 of 3

3TB HD deleted ext4 & formated NTFS

Posted: 28 Apr 2012, 02:30
by danblake
Well I did a stupid. I had 2 3TB hard drives and accidentally nuked the wrong one. :oops:

3TB Seagate HD in an OpenSUSE 12.1 full drive as 1 ext4 partition (just data not system).
Using OpenSUSE 12.1 I delete the ext4 partition.
Using Windows 7 32bit I created an NTFS partition (2.2TB partition size due to 32bit limitation).
I haven't copied any files to the hard drive after the NTFS format (well atleast I stopped being stupid at some point). :roll:

I would like to recover as many files as possible that were on the ext4 partition.

Thanks for listening

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 28 Apr 2012, 18:09
by Fiona
Did TestDisk Deeper Search find your ext4 partition?
Have you been able to list your files?
If TestDisk finds your partition you can mark your partition and press p to list your files.
Please let me know.

Fiona

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 29 Apr 2012, 17:18
by danblake
Fiona,

I'm using a Windows 7 64bit notebook with an i7 processor and 8Gig of ram to scan the drive.

I've been waiting for the first Analyse to finish before replying but I didn't want to wait any longer to get back to you. It's at 73% and I think it's going to many hours more before this initial Analyse is finished. Then I assume I will have the option to do the Deeper Search. Because of the time it is taking to do this scan I think the Deeper Search will literally take days. Is this normal?

Is there any way to speed this up?
Is there a way to force DiskTest to look for ext3, ext4 Superblocks instead of scanning every block?

Should I put this drive back into the OpenSUSE 12.1 workstation to do the TestDisk work?

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 03 May 2012, 04:14
by danblake
Here are the results of the Deeper Search. I don't really understand why it finds these "MS DATA" partitions but it looks like it's saying they have an EXT4 superblock.

Mostly it says

The following partitions can't be recovered:
MS Data 2927889408 8788419583 5860530176
EXT4 Large file Sparse superblock Recover, 3000 GB / 2794 GiB

I tried to attach the testdisk.log in hopes that someone that knows more about testdisk's inner workings can see something I don't. The only thought I have is checking the geometry to make sure it matches properly.

Is it possible to save/backup one of the ext4 superblocks that testdisk has found and maybe I can restore it with another program? All the files are still on this HD. Nothing has been written to it so I'm thinking something like this should be possible.

Thanks for help,

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 03 May 2012, 09:28
by Fiona
Can you have another try to attach the testdisk-log?
Some users reported testdisk.log is not supportet to upload.
Testdisk.txt is not supported either.
Would it be possible to zip it?
Also you can copy and paste the content.

Fiona

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 03 May 2012, 12:25
by danblake
Here you go.

The reason I got into this mess is that I've been having trouble getting OpenSUSE 12.1 to work the way I want as a server. I'm new at linux but not with computers. So I've been doing a lot of installs on this machine. Luckily the 3TB drives haven't been partitioned or formatted much because they aren't system drives, so I have just set mount point during each install.

I've been thinking about this some more. I don't think the geometry could be wrong in the BIOS because I am using the same system that the EXT4 partition was created. It isn't the same machine that did the NTFS partition/formatting but I don't see how that would effect reading/recovering the EXT4 partition data. As long as, I'm running TestDisk on the system that created the EXT4 partition the system should have the same geometry and therefore the HD heads should be aligned properly to read the EXT4 data.

If the BIOS has the correct geometry shouldn't TestDisk? The geometry info isn't written on the HD, but I should be able to get it from Seagates website if needed. I also have a duplicate 3TB HD that I could copy this drive to so I wouldn't be working on the original. Is the TestDisk "copy" function byte for byte? If not I would use a different tool to make this copy.

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 11 May 2012, 12:49
by danblake
I never heard back from anyone after attaching the TestDisk log. I have more information now.

You will see in the log that TestDisk does find some EXT4 superblocks but says they are unrecoverable. The information about those partitions doesn't look right to me though. So I deleted the NTFS partition and ran TestDisk in "NONE" for the partition type. It found the deleted NTFS and EXT4 partition (the information about the EXT4 partition looks correct). But TestDisk won't allow me to set the EXT4 partition as A (active) because it says it can't write because of the mode I scanned in.

So TestDisk can't find the correct information when I scan in the correct mode, but can find the correct information when it can't do anything about it? I don't believe TestDisk was meant to torment people so I must be missing something...

Could someone please tell me how to restore the EXT4 partition information TestDisk finds when I search in "None" mode?

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 11 May 2012, 16:26
by Fiona
Would it be possible to upload a screen including your found partitions?
I will compare the values of the partition and disk.
Then it might be possible to use EFI GPT to add it.
Have you been able to list your files (check your ext4-partition and press p)?

Fiona

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 11 May 2012, 17:16
by danblake
Not home right now. No I haven't been able to list any files.

I have scanned using the EFI GPT partition type and it hasn't come up with what I think is the correct EXT4 partition information. I should be able to get you a screen shot when I get home.

Re: 3TB HD deleted ext4 & formated NTFS

Posted: 11 May 2012, 19:35
by Fiona
TestDisk Quick Search has an option, if you press a (add), you can add your partition.
You can enter the values of your found partition and write it into your partition table.
But in any case, Write is only available if you use GPT.
It means to get the values from your found partition using partition table type None.
Then to use EFI GPT to add your partition.
It will be possible to write your partition using EFI GPT.

Fiona