Which partitions to recover after deeper search?

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
federicopvs
Posts: 2
Joined: 19 Feb 2019, 15:35

Which partitions to recover after deeper search?

#1 Post by federicopvs »

My setup
Dell Chromebook 13 with Windows 10 and Ubuntu 18.10 on dual boot, using MrChromebox UEFI Firmware (4.9)


What happened
I wanted to install Ubuntu on an external usb drive. I took two drives, installed the live version of ubuntu 18.10 on the first, booted into it, and then used the installer to install ubuntu on the second usb.

When the installation finished, I removed the drive and rebooted – just to find out that the laptop boots into GRUB 2.2 (with “Minimal BASH-like editing supported”) rather than into Ubuntu.

I can still boot into Windows by selecting it in the boot manager but if I do nothing the computer goes into GRUB.


What I did
testdisk's first analysis could not find any partition, so I did the deeper search. Here is the result

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
    
    Disk /dev/sda - 256 GB / 238 GiB - CHS 31130 255 63
    
    The harddisk (256 GB / 238 GiB) seems too small! (< 12 TB / 11 TiB)
    Check the harddisk size: HD jumpers settings, BIOS detection...
    
    The following partitions can't be recovered:
       Partition               Start        End    Size in sectors
      Linux Swap              89606136 25289942743 25200336608
       MS Data                257078856  656388551  399309696
       MS Data                257079752  656389447  399309696
       MS Data                257082240  656391935  399309696
       MS Data                257082400  656392095  399309696
       MS Data                257083096  656392791  399309696
       MS Data                257084352  656394047  399309696
       MS Data                257085056  656394751  399309696
       MS Data                257086456  656396151  399309696
       MS Data                257086592  656396287  399309696
    
    [ Continue ]
    SWAP2 version 2674814663, pagesize=8192, 12 TB / 11 TiB
In the following screen I get a list of partitions (or at least I think they are). I checked some of them with `P`, which allows me to see the files contained in each. I think I identified my root partition

Code: Select all

     D MS Data                     2048    1023999    1021952
     D MS Data                  1023999    2045950    1021952
     D MS Data                  1024000    1228799     204800 [NO NAME]
     D MS Data                  1024006    1228805     204800 [NO NAME]
     D MS Data                  1261568   89327144   88065577
     D MS Data                  6173667    6179840       6174
     D MS Data                  6179840    6186013       6174 [Boot]
     D MS Data                  6179859    6186032       6174
     D MS Data                  6186032    6192205       6174 [Boot]
     D MS Data                  6186051    6192224       6174
     D MS Data                  6192224    6198397       6174 [Boot]
     D MS Data                  6192243    6198416       6174
     D MS Data                  6198416    6204589       6174 [Boot]
     D MS Data                  6204624    6207503       2880 [EFISECTOR]
     D MS Data                  6207504    6210383       2880 [EFISECTOR]
     D MS Data                 17739774  417049469  399309696
     D MS Data                 17739776  417049471  399309696
     D MS Data                 22864947   22871120       6174
     D MS Data                 22871120   22877293       6174 [Boot]
     D MS Data                 78493568   78496447       2880 [EFISECTOR]
     D MS Data                 81325576   81328455       2880 [EFISECTOR]
     D MS Data                 81328456   81331335       2880 [EFISECTOR]
     D MS Data                 86914272   86917151       2880 [EFISECTOR]
     D MS Data                 89327144  177392720   88065577
     D MS Data                 89327614  500117501  410789888
     D MS Data                 89327616  500117503  410789888    // this is where my root folder is
     D Linux Swap              89606144   93800431    4194288
     D MS Data                154662036  154666963       4928 [NO NAME]
     D MS Data                222556160  305313791   82757632
     D MS Data                237681520  237684399       2880 [EFISECTOR]
     D MS Data                299342267  299345146       2880 [NO NAME]
     D MS Data                305313791  388071422   82757632
     D MS Data                316486379  316489258       2880 [NO NAME]
     D MS Data                316486403  316489282       2880 [NO NAME]
     D MS Data                332211579  332214458       2880 [NO NAME]
     D MS Data                395771312  395774191       2880 [EFISECTOR]
     D MS Data                395774192  395777071       2880 [EFISECTOR]
     D MS Data                417052670  500117501   83064832
     D MS Data                417052672  500117503   83064832
     D MS Data                468003251  468006130       2880 [NO NAME]
     D MS Data                468004147  468007026       2880 [NO NAME]
     D MS Data                471783563  471786442       2880 [NO NAME]
Here is the full log (note that I ran the deep search twice)

Should I just try to change that partition characteristics from `D=deleted` to `P=primary`?

Are there any other partitions I should recover? When I try to visualize file in many of them (like the preceding one) I only get this message: `Can't open filesystem. Filesystem seems damaged.`

Or should I just give up and reinstall everything or is there still some hope?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Which partitions to recover after deeper search?

#2 Post by cgrenier »

Can you list the files from the following partition ?

Code: Select all

     MS Data                 89327616  500117503  410789888
     ext4 blocksize=4096 Large_file Sparse_SB, 210 GB / 195 GiB
The correct partition table may be

Code: Select all

 1 P Unknown                     2048    1023999    1021952 [Basic data partition]
 2 P EFI System               1024000    1228799     204800 [EFI system partition]
 3 P MS Reserved              1228800    1261567      32768 [Microsoft reserved partition]
 4 P MS Data                  1261568   89327144   88065577 [Basic data partition]
 5 P MS Data                 89327616  500117503  410789888

federicopvs
Posts: 2
Joined: 19 Feb 2019, 15:35

Re: Which partitions to recover after deeper search?

#3 Post by federicopvs »

I had to re-do the deep analysis and now it seems to have changed a bit.

Code: Select all

D MS Data                     2048    1023999    1021952 [Recovery]
 D MS Data                  1023999    2045950    1021952
 D EFI System               1024000    1228799     204800 [EFI System Partition] [NO NAME]
 D MS Data                  1024006    1228805     204800 [NO NAME]
 D MS Data                  1261568   89327144   88065577
 D MS Data                  6173667    6179840       6174
 D MS Data                  6179840    6186013       6174 [Boot]
 D MS Data                  6179859    6186032       6174
 D MS Data                  6186032    6192205       6174 [Boot]
 D MS Data                  6186051    6192224       6174
 D MS Data                  6192224    6198397       6174 [Boot]
 D MS Data                  6192243    6198416       6174
 D MS Data                  6198416    6204589       6174 [Boot]
 D EFI System               6204624    6207503       2880 [EFI System Partition] [EFISECTOR]
 D EFI System               6207504    6210383       2880 [EFI System Partition] [EFISECTOR]
 D Linux filesys. data     17739774  417049469  399309696
 D Linux filesys. data     17739776  417049471  399309696
 D MS Data                 22864947   22871120       6174
 D MS Data                 22871120   22877293       6174 [Boot]
 D EFI System              78493568   78496447       2880 [EFI System Partition] [EFISECTOR]
 D EFI System              81325576   81328455       2880 [EFI System Partition] [EFISECTOR]
 D EFI System              81328456   81331335       2880 [EFI System Partition] [EFISECTOR]
 D EFI System              86914272   86917151       2880 [EFI System Partition] [EFISECTOR]
 D MS Data                 89327144  177392720   88065577
 D Linux filesys. data     89327614  500117501  410789888
 D Linux filesys. data     89327616  500117503  410789888
 D Linux Swap              89606144   93800431    4194288
 D EFI System             154662036  154666963       4928 [EFI System Partition] [NO NAME]
 D MS Data                222556160  305313791   82757632
 D MS Data                237681520  237684399       2880 [EFISECTOR]
 D MS Data                299342267  299345146       2880 [NO NAME]
 D MS Data                305313791  388071422   82757632
 D MS Data                316486379  316489258       2880 [NO NAME]
 D MS Data                316486403  316489282       2880 [NO NAME]
 D MS Data                332211579  332214458       2880 [NO NAME]
 D MS Data                395771312  395774191       2880 [EFISECTOR]
 D MS Data                395774192  395777071       2880 [EFISECTOR]
 D Linux filesys. data    417052670  500117501   83064832
 D Linux filesys. data    417052672  500117503   83064832
 D MS Data                468003251  468006130       2880 [NO NAME]
 D MS Data                468004147  468007026       2880 [NO NAME]
 D MS Data                471783563  471786442       2880 [NO NAME]
Anyways the content of the section you asked (which now appears as "Linux filesys. data" rather than "MS data" are my ubuntu root folder

Code: Select all

drwxr-xr-x     0     0      4096  7-Feb-2019 14:51 .
 drwxr-xr-x     0     0      4096  7-Feb-2019 14:51 ..
 drwx------     0     0     16384 14-Jan-2019 15:36 lost+found
 drwxr-xr-x     0     0      4096  7-Feb-2019 14:52 boot
 -rw-------     0     0 2147483648 14-Jan-2019 15:36 swapfile
 drwxr-xr-x     0     0     12288 15-Feb-2019 10:36 etc
 drwxr-xr-x     0     0      4096 16-Jan-2019 16:38 media
 drwxr-xr-x     0     0      4096 17-Oct-2018 22:36 var
 drwxr-xr-x     0     0      4096 14-Jan-2019 16:00 bin
 drwxr-xr-x     0     0      4096 17-Oct-2018 22:23 dev
 drwxr-xr-x     0     0      4096 14-Jan-2019 15:38 home
 drwxr-xr-x     0     0      4096 16-Jan-2019 17:00 lib
 drwxr-xr-x     0     0      4096 17-Oct-2018 22:23 lib64
 drwxr-xr-x     0     0      4096 17-Oct-2018 22:23 mnt
 drwxr-xr-x     0     0      4096 14-Jan-2019 17:14 opt
 drwxr-xr-x     0     0      4096 15-Oct-2018 17:10 proc
 drwx------     0     0      4096 23-Jan-2019 15:59 root
 drwxr-xr-x     0     0      4096 17-Oct-2018 22:34 run
 drwxr-xr-x     0     0     12288 16-Jan-2019 18:58 sbin
 drwxr-xr-x     0     0      4096 13-Feb-2019 09:54 snap
 drwxr-xr-x     0     0      4096 17-Oct-2018 22:23 srv
 drwxr-xr-x     0     0      4096 15-Oct-2018 17:10 sys
 drwxrwxrwt     0     0      4096 15-Feb-2019 20:00 tmp
 drwxr-xr-x     0     0      4096 17-Oct-2018 22:28 usr
 lrwxrwxrwx     0     0        33  7-Feb-2019 14:51 initrd.img
 lrwxrwxrwx     0     0        33 14-Jan-2019 15:40 initrd.img.old
 lrwxrwxrwx     0     0        30  7-Feb-2019 14:51 vmlinuz
 lrwxrwxrwx     0     0        30  7-Feb-2019 14:51 vmlinuz.old
 drwxr-xr-x     0     0      4096 14-Jan-2019 15:38 cdrom
 lrwxrwxrwx     0     0        33  7-Feb-2019 14:51 initrd.img.861919
Should I just move that one from D to P? What about all the others?

Locked