Filesystem repair after brief accidental erase by Ubuntu
Posted: 09 Oct 2012, 14:33
Hi here's my current situation:
I have a notebook with dual boot: Win XP and Ubuntu.
I have an external Western Digital 2 TB USB hard disk with two 1-GB partitions: partition "Disco di backup" is a Linux 1 TB partition (where I have a filesystem and .JPG files that I want to recover) and "NTFS" partition is a 1 TB NTFS partition (obviously!!) where I do not have any files that I want to recover.
Partition "Disco di backup" was only visible by Ubuntu and not by Win XP.
At some point I wanted to create a bootable USB device for the new release of Ubuntu on my "NFTS" partition so I launched the Ubuntu "Startup disk creator" which prompted me to "Erase" the disk before installing the new release of Ubuntu. I thought that this command would erase only the "NTFS" partition and I launched it. After about 30 seconds I realized that the command was erasing all hard disk (i.e. both "Disco di backup" and "NTFS" partitions) and I stopped the program. I do not think that in those 30 seconds all my JPG files could be completely erased (they are GB of files).
After that, from Ubuntu I could only see the 2TB ext. USB HD as a single partition and no files (well, some unreadable files were present but they have names made up by symbols).
I launched testdisk and found somehow the "Disco di backup" partition and changed its status from D(eleted) to P(rimary). Now Ubuntu see the ext. USB HD as a 1TB partition but with the same unreadable files (no sign of either the Linux partition filesystem or the lost JPG files).
After that first run of testdisk, I run test disk again and again and here is the log file contents:
*********
Tue Oct 9 15:10:55 2012
Command line: TestDisk
TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.31-14-generic (#48-Ubuntu SMP Fri Oct 16 14:04:26 UTC 2009)
Compiler: GCC 4.4 - Jun 23 2009 17:11:34
ext2fs lib: 1.41.11, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 156301488 sectors
/dev/sda: user_max 156301488 sectors
/dev/sda: native_max 156301488 sectors
/dev/sda: dco 156301488 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - ATA FUJITSU MHV2080B
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WD Ext HDD 1021
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - WD Ext HDD 1021
Partition table type: Intel
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 83
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
No EXT2, JFS, Reiser, cramfs or XFS marker
1 P Linux 0 1 1 121575 254 63 1953118377
1 P Linux 0 1 1 121575 254 63 1953118377
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
FAT32 at 0/1/1
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
FAT differs, FAT sectors=0-16/953398
set_FAT_info: name from BS used
FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
* FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
interface_write()
1 * FAT32 LBA 0 1 1 243200 254 63 3907024002
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
FAT32 at 0/1/1
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
FAT differs, FAT sectors=0-16/953398
set_FAT_info: name from BS used
FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
FAT32 at 0/1/7
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
set_FAT_info: name from BS used
FAT32 at 0/1/7
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT found using backup sector!, 2000 GB / 1863 GiB
block_group_nr 3
recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/7450, s_mnt_count=5/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244139797
recover_EXT2: part_size 1953118376
Linux 0 1 1 121575 254 62 1953118376 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=4
Results
Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
interface_write()
1 P Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Need to fix
1 P Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
You will have to reboot for the change to take effect.
TestDisk exited normally.
***********
Now the problem is that after reboot, if I run testdisk again, the Linux partition is always D(eleted) and I go through the above process again and again without change in the status of the Linux partition and without getting to see any JGP lost files. I suppose the filesystem is corrupted, is that correct?
Problem is that I also run PhotoRec but it goes on forever (I let it run for 3 days) but the count of the analyzed cylinders sometimes decreases insted of always increasing so it will never reach the end and it recovered many .jpg files which were in the other (NTFS) partition.
My question: is there a way to restore the structure of the folders in the Linux partition (Disco di backup) and/or then to recover .JPG files from there?
Thanks a lot
Mattia
PS if needed I can attach screenshots of each step of testdisk and also a screenshot of which files I see now in the HD.
I have a notebook with dual boot: Win XP and Ubuntu.
I have an external Western Digital 2 TB USB hard disk with two 1-GB partitions: partition "Disco di backup" is a Linux 1 TB partition (where I have a filesystem and .JPG files that I want to recover) and "NTFS" partition is a 1 TB NTFS partition (obviously!!) where I do not have any files that I want to recover.
Partition "Disco di backup" was only visible by Ubuntu and not by Win XP.
At some point I wanted to create a bootable USB device for the new release of Ubuntu on my "NFTS" partition so I launched the Ubuntu "Startup disk creator" which prompted me to "Erase" the disk before installing the new release of Ubuntu. I thought that this command would erase only the "NTFS" partition and I launched it. After about 30 seconds I realized that the command was erasing all hard disk (i.e. both "Disco di backup" and "NTFS" partitions) and I stopped the program. I do not think that in those 30 seconds all my JPG files could be completely erased (they are GB of files).
After that, from Ubuntu I could only see the 2TB ext. USB HD as a single partition and no files (well, some unreadable files were present but they have names made up by symbols).
I launched testdisk and found somehow the "Disco di backup" partition and changed its status from D(eleted) to P(rimary). Now Ubuntu see the ext. USB HD as a 1TB partition but with the same unreadable files (no sign of either the Linux partition filesystem or the lost JPG files).
After that first run of testdisk, I run test disk again and again and here is the log file contents:
*********
Tue Oct 9 15:10:55 2012
Command line: TestDisk
TestDisk 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 2.6.31-14-generic (#48-Ubuntu SMP Fri Oct 16 14:04:26 UTC 2009)
Compiler: GCC 4.4 - Jun 23 2009 17:11:34
ext2fs lib: 1.41.11, ntfs lib: 10:0:0, reiserfs lib: none, ewf lib: none
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 156301488 sectors
/dev/sda: user_max 156301488 sectors
/dev/sda: native_max 156301488 sectors
/dev/sda: dco 156301488 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - CHS 1 1 1, sector size=512
Hard disk list
Disk /dev/sda - 80 GB / 74 GiB - CHS 9729 255 63, sector size=512 - ATA FUJITSU MHV2080B
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63, sector size=512 - WD Ext HDD 1021
Partition table type (auto): Intel
Disk /dev/sdb - 2000 GB / 1863 GiB - WD Ext HDD 1021
Partition table type: Intel
Analyse Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243201 255 63
Geometry from i386 MBR: head=255 sector=63
check_part_i386 failed for partition type 83
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=2
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Current partition structure:
No EXT2, JFS, Reiser, cramfs or XFS marker
1 P Linux 0 1 1 121575 254 63 1953118377
1 P Linux 0 1 1 121575 254 63 1953118377
No partition is bootable
Ask the user for vista mode
Computes LBA from CHS for Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
Allow partial last cylinder : Yes
search_vista_part: 1
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
FAT32 at 0/1/1
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
FAT differs, FAT sectors=0-16/953398
set_FAT_info: name from BS used
FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
get_geometry_from_list_part_aux head=255 nbr=2
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=2
Results
* FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
interface_write()
1 * FAT32 LBA 0 1 1 243200 254 63 3907024002
search_part()
Disk /dev/sdb - 2000 GB / 1863 GiB - CHS 243202 255 63
FAT32 at 0/1/1
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
FAT differs, FAT sectors=0-16/953398
set_FAT_info: name from BS used
FAT32 at 0/1/1
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
FAT32 at 0/1/7
FAT1 : 32-953429
FAT2 : 953430-1906827
start_rootdir : 1906828 root cluster : 2
Data : 1906828-3907023979
sectors : 3907024002
cluster_size : 32
no_of_cluster : 122034911 (2 - 122034912)
fat_length 953398 calculated 953398
set_FAT_info: name from BS used
FAT32 at 0/1/7
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT found using backup sector!, 2000 GB / 1863 GiB
block_group_nr 3
recover_EXT2: "e2fsck -b 98304 -B 4096 device" may be needed
recover_EXT2: s_block_group_nr=3/7450, s_mnt_count=5/31, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 244139797
recover_EXT2: part_size 1953118376
Linux 0 1 1 121575 254 62 1953118376 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
Search for partition aborted
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=3
get_geometry_from_list_part_aux head=16 nbr=2
get_geometry_from_list_part_aux head=32 nbr=2
get_geometry_from_list_part_aux head=64 nbr=2
get_geometry_from_list_part_aux head=128 nbr=2
get_geometry_from_list_part_aux head=240 nbr=2
get_geometry_from_list_part_aux head=255 nbr=4
Results
Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
FAT32 LBA 0 1 1 243200 254 63 3907024002
FAT32, 2000 GB / 1863 GiB
interface_write()
1 P Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
write!
write_mbr_i386: starting...
write_all_log_i386: starting...
No extended partition
Need to fix
1 P Linux 0 1 1 121575 254 63 1953118377 [Disco di backup]
EXT4 Large file Sparse superblock Backup superblock, 999 GB / 931 GiB
You will have to reboot for the change to take effect.
TestDisk exited normally.
***********
Now the problem is that after reboot, if I run testdisk again, the Linux partition is always D(eleted) and I go through the above process again and again without change in the status of the Linux partition and without getting to see any JGP lost files. I suppose the filesystem is corrupted, is that correct?
Problem is that I also run PhotoRec but it goes on forever (I let it run for 3 days) but the count of the analyzed cylinders sometimes decreases insted of always increasing so it will never reach the end and it recovered many .jpg files which were in the other (NTFS) partition.
My question: is there a way to restore the structure of the folders in the Linux partition (Disco di backup) and/or then to recover .JPG files from there?
Thanks a lot
Mattia
PS if needed I can attach screenshots of each step of testdisk and also a screenshot of which files I see now in the HD.