[SOLV] How 2recover partition layout found with Deep Search? Topic is solved

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
kozaki
Posts: 3
Joined: 13 Mar 2016, 11:58

[SOLV] How 2recover partition layout found with Deep Search?

#1 Post by kozaki »

Hello, nice informative forum.

One 1 TB external Sata drive (USB 3.0 connected, 4 primary partitions, lots of data in #4). Accidentally reformated from a NAS live system that I was reviewing (saw no clear warning that it'll format the whole drive). I could only stop the write process ASAP: morron system had already written its new partition table and a few files in its /boot. I then let the HDD "as is" till launching TestDisk.

Partition layout before (let's call it "Good"):

Code: Select all

 1 P* Linux ext4  # don't care
 2 P Linux swap
 3 P Linux ext4  # don't care
 4 P Linux XFS  # has valuable data
Partition layout after my mistake ("Wrong"):

Code: Select all

 1 P Linux                    0  32 33 121081 220 35 1945178112
 2 E extended             121081 253  3 121601  57 56    8341506
 5 L Linux Swap           121081 253  5 121601  57 56    8341504
Goal is to recover partition 4 data (or learn in the process).

1. To find the Good partiition layout back I did:

- Quick search; shows the Wrong layout.

- Advanced search shows the Good layout:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015                                     
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
    Partition               Start        End          Size in sectors
    D Linux                    0  32 33 121081 220 35 1945178112
    D Linux                    0 130  1     13  65 63     204813 [momboot]  «- sdb1
   >D Linux Swap              13  65 53    510 111 49    7987200            «- sdb2
    D Linux                  510 111 50   1275  84 25   12288000 [momos]    «- sdb3
    D Linux                 1275  84 26 121601  57 56 1933035520 [momedias] «- sdb4
    D Linux Swap          121081 253  5 121601  57 56    8341504
full TestDisk log

2. To restore the Good partition layout

TestDisk <p> show "fs error" (or alike) on wanted partition 4 (files from partition 3 only).

Changed partition type to reflect original partition layout:

Code: Select all

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
 D Linux                    0  32 33 121081 220 35 1945178112
 P Linux                    0 130  1    13  65 63     204813 [momboot]
 P Linux Swap              13  65 53   510 111 49    7987200
 P Linux                  510 111 50  1275  84 25   12288000 [momos]
>P Linux                 1275  84 26 121601  57 56 1933035520 [momedias]
 D Linux Swap           121081 253  5 121601  57 56    8341504
Pressing <Return> doesn't allow me to go any further

Code: Select all

Invalid partition structure.
Did this three times already

Upon searching doc, forum and blogs

- It looks like Recovery_of_reformatted_partition differs from this case where a new partition table was written.

- Would Recovery Process after partition reformated apply in this case?
There cgrenier says to use advanced commands to add a new partition with specific Starting and Ending Cylinder values from our logs, and a partition type.

- MASTER NINJA blog has closest case I found atm ("UPDATE" part). Basically he suceeded to recover his Good partition layout by setting partition type correctly (*/P/L/D) and voilà! Ha, but that doesn't work for my Momentus (XFS) partition!
Last edited by kozaki on 13 Mar 2016, 16:15, edited 1 time in total.

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: How to recover partition layout found with Deep Search?

#2 Post by cgrenier »

Set the SWAP partition as deleted. This way you will avoid overlapping partitions.

kozaki
Posts: 3
Joined: 13 Mar 2016, 11:58

Re: How to recover partition layout found with Deep Search?

#3 Post by kozaki »

Code: Select all

Disk /dev/sdd - 1000 GB / 931 GiB - CHS 121601 255 63
    Partition               Start        End          Size in sectors
    D Linux                    0  32 33 121081 220 35 1945178112
    P Linux                    0 130  1     13  65 63     204813 [momboot]  «- sdb1
   >D Linux Swap              13  65 53    510 111 49    7987200            «- sdb2
    P Linux                  510 111 50   1275  84 25   12288000 [momos]    «- sdb3
    P Linux                 1275  84 26 121601  57 56 1933035520 [momedias] «- sdb4
    D Linux Swap          121081 253  5 121601  57 56    8341504
does work, recovered all the data after a (busy) xfs_repair yeah!

Thank you Christophe for a fast and judicious help. Wish to make answers as short yet as effective :)

Can someone elaborate on Christophe's answer? I can't see that first swap partition (that TestDisk found above) was overlapping?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: [SOLV] How 2recover partition layout found with Deep Sea

#4 Post by cgrenier »

The partition momboot was ending a little after the beginning of the first swap. It's why not using the first swap was a solution.

Note that TestDisk 7.1-WIP may have been to detect the partition conflict and avoid it.

kozaki
Posts: 3
Joined: 13 Mar 2016, 11:58

Re: [SOLV] How 2recover partition layout found with Deep Sea

#5 Post by kozaki »

Than you, now I can see the cylinder (or heads) overlap between these partitions.

Yeah that'd be cool. Would have saved me a few hours guessing and starting up deep search all over again. Which is not that bad considering the amount of data on the partition I did kinda lost ;)

EDIT PS: I can't find a desc' of the diff between TestDisk and TestDisk-WIP on the wiki, the wikipedia articles, and my distro's package manager :/

Locked