I am trying to retrieve data from an overwritten ext4 partition, labelled "Home". I have found possible target partitions via testdisk, but cannot list their files.
Initially Testdisk found 2 such possible partitions, but could not display them because of the "This partition ends after the disk limits" error.
Code: Select all
TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Linux, kernel 4.11.3-200.fc25.x86_64 (#1 SMP Thu May 25 19:03:07 UTC 2017) x86_64
Compiler: GCC 6.0
Compilation date: 2016-03-28T13:31:33
ext2fs lib: 1.43.3, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: 20140608, curses lib: ncurses 6.0
/dev/sda: LBA, HPA, LBA48, DCO support
/dev/sda: size 250069680 sectors
/dev/sda: user_max 250069680 sectors
/dev/sda: native_max 250069680 sectors
Warning: can't get size for Disk /dev/mapper/control - 0 B - 0 sectors, sector size=512
Hard disk list
Disk /dev/sda - 128 GB / 119 GiB - CHS 15566 255 63, sector size=512 - LITEONIT L8T-128L6G-HP, S/N:002345142118, FW:D871701
Partition table type (auto): EFI GPT
Disk /dev/sda - 128 GB / 119 GiB - LITEONIT L8T-128L6G-HP
Partition table type: None
---break---
LVM magic value at 10237/103/25
LVM magic value at 10985/66/38
recover_EXT2: s_block_group_nr=0/781, s_mnt_count=8/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 25602560
recover_EXT2: part_size 204820480
ext4 13015 40 16 25764 163 61 204820480 [Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 104 GB / 97 GiB
This partition ends after the disk limits. (start=209088510, size=204820480, end=413908989, disk end=250069680)
LVM magic value at 14551/41/6
recover_EXT2: s_block_group_nr=0/781, s_mnt_count=8/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 25602560
recover_EXT2: part_size 204820480
ext4 14712 50 57 27461 174 39 204820480 [Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 104 GB / 97 GiB
This partition ends after the disk limits.[/b] (start=236351486, size=204820480, end=441171965, disk end=250069680)
Code: Select all
New geometry
Disk /dev/sda - 211 GB / 197 GiB - CHS 25765 255 63 sector_size=512
New options :
Dump : No
Align partition: No
Expert mode : Yes
---break---
LVM magic value at 10237/103/25
LVM magic value at 10985/66/38
recover_EXT2: s_block_group_nr=0/781, s_mnt_count=8/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 25602560
recover_EXT2: part_size 204820480
ext4 13015 40 16 25764 163 61 204820480 [Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 104 GB / 97 GiB
LVM magic value at 14551/41/6
recover_EXT2: s_block_group_nr=0/781, s_mnt_count=8/4294967295, s_blocks_per_group=32768, s_inodes_per_group=8192
recover_EXT2: s_blocksize=4096
recover_EXT2: s_blocks_count 25602560
recover_EXT2: part_size 204820480
ext4 14712 50 57 27461 174 39 204820480 [Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 104 GB / 97 GiB
Code: Select all
dir_partition inode=2
P ext4 14712 50 57 27461 174 39 204820480 [Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 104 GB / 97 GiB
ext2fs_dir_iterate failed with error 2133571387.
Directory /
dir_partition inode=2
P ext4 13015 40 16 25764 163 61 204820480 [Home]
ext4 blocksize=4096 Large_file Sparse_SB Recover, 104 GB / 97 GiB
ext2fs_dir_iterate failed with error 2133571387.
Directory /
ntfs_device_testdisk_io_ioctl() unimplemented
ntfs_device_testdisk_io_ioctl() unimplemented
I'm also curious about expert options in testdisk, can these help? And do i maybe need to install additional libraries in linux to read these partitions?
As a secondary solution, photorec seems to scan only current partitions, so how do i direct photorec to scan these deleted partitions?
A similar issue has been raised on the forums before, but I did not find a solution: Topic 1 and Topic 2
Thank you for your suggestions.