How to repair a partition table after mistakenly saved by testdisk?

[hlechner]

Hello all,

I do have a 3TB HDD on my Arch linux for some years now (maybe 2 or 3 years) which is divided in three partitions:
- PTR 1 (EXT4)
- PTR 2 (EXT4)
- PTR 3 (NTFS)

The system itself run outside of this HDD, the partition 1 (PTR 1) was corrupted somehow and I tried to recover the partition, it seems to be badblock at first but I couldn't repair it, so I've tested the TestDisk to re-find the partition.

However in the process I've made a big mistake of not take all attention on the process, by using too many tabs on terminal and accidentally found and saved the partitions however it was not exactly was it suppose to be, then it make the "PTR 2" and "PTR 3" unavailable.

It recognise it as EFI GPT however, it in real is Intel:

Code: Select all

Hint: EFI GPT partition table type has been detected.

and I proceeded anyway, so, it first removed the partitions PTR 2 and PTR 3, so I've started the testdisk again after recognize my error, and I select Intel to repair it, but it found a different partition tables.

But due to the fact that I had the partitions already mounted I still have access to it normally, but if do reboot or umount it, i'll gonna lose the access to the filesystem.
Here the output of df (of these partitions):

Code: Select all

/dev/sdc2       1.2T  937G  165G  86% /run/media/hlechner/PTR2
/dev/sdc3       684G   76G  609G  12% /run/media/hlechner/PTR3

Result of gparted for example:

Hitting Ignore:

Hitting ignore again:


As you can see the partitions are different sizes now, and do have two "unallocated" which doesn't have before.

What TestDisk found:

Code: Select all

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdc - 3000 GB / 2794 GiB - CHS 364801 255 63
     Partition               Start        End    Size in sectors
>* Linux                    0   1  1 121575 254 63 1953118377 [PTR1]
 P Linux                121602 225 32 275563 200 29 2473381888 [PTR2]
 P HPFS - NTFS          275563 200 30 364801  66  1 1433600000

The result of saving it is what gparted shows in the images above.

The situation get even odder when I use the deeper search instead of quick one, it "found" even more partitions, but in reality it should found only 3 partitions in total.

So, the important to me now is to repair the two partitions that I had working before (PTR 2 and PTR 3) -- I have access to it due the fact it still mounted on system -- that I probably gonna lose if I reboot the system.

What do you guys recommend me to do to repair it?

Thanks very much!

[cgrenier]

You can get the partition size using "cat /proc/partitions".

Usually disk bigger than 2TB are using EFI GPT.
Run TestDisk, Advanced, for each partition, try List. If you can see your files, it's probably ok.

[hlechner]

Thanks sir,

I tested list files by EFI GPT but no success at all. under the quick search it found only PTR 1 but it is not accessible. and under deep search it found many partitions.


And by Intel I can list PTR 2 but not PTR 3.

You have mentioned the /proc/partitions, there is a way that I can manually set it?

Code: Select all

# cat /proc/partitions 
major minor  #blocks  name

   8        0  468851544 sda
   8        1     979933 sda1
   8        2   29294527 sda2
   8        4  136721182 sda4
   8        5   78124063 sda5
   8        6  223731742 sda6
   8       16   62566400 sdb
   8       17   62564118 sdb1
   8       32 2930266584 sdc
   8       33  976559188 sdc1
   8       34 1236690944 sdc2
   8       35  716800000 sdc3
  11        0    1048575 sr0

[cgrenier]

Please provide a copy of the testdisk.log file