Wrote 17MB Windows 10 Boot Partition over 4TB EXT4

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
takkun324
Posts: 2
Joined: 30 Jun 2018, 16:54

Wrote 17MB Windows 10 Boot Partition over 4TB EXT4

#1 Post by takkun324 »

[[[ I feel like I'm trying to shoot a bullseye in the dark. ]]]

*** Just let me know if I need to seek help elsewhere. Any help is appreciated. I've done a lot of research and most of it was from these forums.

SITUATION - THE CAUSE:
After installing Ubuntu 18.04, Windows 10 wouldn't boot. Normally I just reinstall windows. On&off research pointed to a missing boot-partition so I created one with the Recovery command-line from the install disk. I switched the C volume over to the correct partition and ran: bootrec /rebuildbcd. I didn't realize it would write it over the first partition of the first drive. The strange thing is, while windows once-again booted just-fine, I could still access my files perfectly in Ubuntu!

In windows 10 I started to setup Ext2Fsd (I think it was) to re-link (or reinstall) my Steam game-archive. The Windows 10 Disk Management displayed the drive as "Unknown" ... said there was a problem but it could fix it automatically. I said "OK/Yes" and that was "the" huge mistake. The boot-partition was now visible and the rest of the drive was labeled "Unknown" (or "Unformatted", I forgot which). I booted back into ubuntu and see the same thing in "disks". 17mb for the boot partition and the rest labeled "Free Space"/"Unallocated Space". Sigh... I'm currently staying in Ubuntu until this is fixed.

SITUATION - IN TESTDISK:
Testdisk gave me a little bit of hope. Using the default sector size of 512, scans easily picks up my partition name I used: [sda - 4TB WD] but the ones with files listed show seemingly random-character file-name mess.

SITUATION - OTHER STUFF:
  • The damaged sda partition was just used as a file-storage archive: Photos, Music, Documents, Game-Installs, etc...
  • I have a new 4TB drive (I'll later use for backups) arriving today to backup the damaged drive.
  • Using DD, I've created an image file of the first 1GB of the drive. However, I can't mount it. Is there some way I can use this backup to scan instead of the original drive that is 400x larger?
  • A "quick" scan takes about 6 hours. A "detailed" scan takes about 9 hours.
  • Table: Honestly I'm not sure if I used GPT. I think I did but I'm not sure. If I could use EXT4 without a partition table ("None"), I might have done that (which was a year ago).
  • Sectors: I think the sector size was large. Either 4016 or 6000something. I don't think it was as high as 8000...
ALREADY DID:
  • 4 or 5 times: Pressed "ENTER" to "Continue" instead of "P" to "View Files". Sigh... It has been days.
  • One QUICK scan: INTEL & EXT4 using a sector size of the default 512. Some possible partitions but none with files.
  • Two DETAILED scans: GPT & EXT4 using a sector size of the default 512. Some possible partitions, 1 or 2 with files of garbled-names.
FILELS & LOGS: CURRENT:
STOPPED > Running a DETAILED scan: GPT & EXT4 using a sector size of 4016. (I just noticed the sector size today.) I may have to restart this scan if I have time to install the drive before leaving for work.
STARTED > Running a backup using DD onto a new 4tb disk. At this rate it should be done July 8th~ish?
Last edited by takkun324 on 05 Jul 2018, 13:00, edited 2 times in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Wrote 17MB Windows 10 Boot Partition over 4TB EXT4

#2 Post by cgrenier »

It looks like the ext4 filesystem was using the whole disk. Run TestDisk, /dev/sda, None, Advanced, if necessary, force the type to ext4, SuperBlock.
Use fsck.ext4 /dev/sda with the blocksize and block number given by testdisk.

takkun324
Posts: 2
Joined: 30 Jun 2018, 16:54

Re: Wrote 17MB Windows 10 Boot Partition over 4TB EXT4

#3 Post by takkun324 »

That's it! Thank you! Can I ask what directed you to suggest [None] for a partition table?

When I used Testdisk to analyze a [None] & [EXT4] file-system, it could not list any files; saying the file-system was damaged. I had more promising (IMHO) results with GPT so I just assumed. However, after the backup was completed (after days), I tested the suggestion on the backup and I have all my files back!
  • "sde" is my new backup disk.
  • The values for "-b" and "-B" were taken from the listed superblock backups retrieved by testdisk (all listed superblocks were identical - so that helped).
  • I ran e2fsck to repair errors in the filesystem, knowing the first 16 Mbs were already overwriten.

Code: Select all

sudo fsck.ext4 -p -v -b 229376 -B 4096 /dev/sde
sudo e2fsck -v -y /dev/sde
Thank you! :D

Locked